  def self.loginByToken(session, cookies)
    if username = validToken(cookies["token"])
      if SUPERUSER == username
        if cookies['CIB_user'] and cookies['CIB_user'].strip != ''
          session[:username] = cookies['CIB_user']
          if cookies['CIB_user_groups'] and cookies['CIB_user_groups'].strip != ''
            session[:usergroups] = cookieUserDecode(
              cookies['CIB_user_groups']
            ).split(nil)
          else
            session[:usergroups] = []
          end
        else
          session[:username] = SUPERUSER
          session[:usergroups] = []
        end
        return true
      else
        session[:username] = username
        success, groups = getUsersGroups(username)
        session[:usergroups] = success ? groups : []
        return true
      end
    end
    return false
  end
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.