  def testLoginByToken
    users = []
    users << {"username" => "user1", "token" => "token1"}
    users << {"username" => "user2", "token" => "token2"}
    users << {"username" => SUPERUSER, "token" => "tokenS"}
    password_file = File.open($user_pass_file, File::RDWR|File::CREAT)
    password_file.truncate(0)
    password_file.rewind
    password_file.write(JSON.pretty_generate(users))
    password_file.close()

    session = {}
    cookies = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(false, result)
    assert_equal({}, session)

    session = {}
    cookies = {'token' => 'tokenX'}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(false, result)
    assert_equal({}, session)

    session = {}
    cookies = {'token' => 'token1'}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
    assert_equal(
      {:username => 'user1', :usergroups => ['group1', 'haclient']},
      session
    )

    session = {}
    cookies = {
      'token' => 'token1',
      'CIB_user' => 'userX',
      'CIB_user_groups' => PCSAuth.cookieUserEncode('groupX')
    }
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
    assert_equal(
      {:username => 'user1', :usergroups => ['group1', 'haclient']},
      session
    )

    session = {}
    cookies = {'token' => 'tokenS'}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
    assert_equal(
      {:username => SUPERUSER, :usergroups => []},
      session
    )

    session = {}
    cookies = {
      'token' => 'tokenS',
      'CIB_user' => 'userX',
      'CIB_user_groups' => PCSAuth.cookieUserEncode('groupX')
    }
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
    assert_equal(
      {:username => 'userX', :usergroups => ['groupX']},
      session
    )
  end
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.