function create_resource(form, update, stonith) {
  dataString = $(form).serialize();
  var resourceID = $(form).find("[name='name']").val(); 
  url = get_cluster_remote_url() + $(form).attr("action");
  var name;

  if (stonith)
    name = "fence device";
  else
    name = "resource"

  ajax_wrapper({
    type: "POST",
    url: url,
    data: dataString,
    dataType: "json",
    success: function(returnValue) {
      $('input.apply_changes').show();
      if (returnValue["error"] == "true") {
        alert(returnValue["stderr"]);
      } else {
        Pcs.update();
        if (!update) {
          if (stonith)
            $('#add_stonith').dialog('close');
          else
            $('#add_resource').dialog('close');
        } else {
          reload_current_resource();
        }
      }
    },
    error: function(xhr, status, error) {
      if (update) {
        alert(
          "Unable to update " + name + " "
          + ajax_simple_error(xhr, status, error)
        );
      }
      else {
        alert(
          "Unable to add " + name + " "
          + ajax_simple_error(xhr, status, error)
        );
      }
      $('input.apply_changes').show();
    }
  });
}
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.