    function restart($sMessage = '')
    {
        $_COOKIE['sessionID'] = phpAds_SessionRegenerateId();
        OA_Auth::displayLogin($sMessage, $_COOKIE['sessionID']);
    }
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.