    public function refreshUser(UserInterface $user)
    {
        return $this->changeUser($this->inner->refreshUser($user));
    }
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.