def create_cluster(params, request, session)
  if not allowed_for_superuser(session)
    return 403, 'Permission denied'
  end
  if set_corosync_conf(params, request, session)
    cluster_start(params, request, session)
  else
    return "Failed"
  end
end
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.