  def self.getSuperuserSession()
    return {
      :username => SUPERUSER,
      :usergroups => [],
    }
  end
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.