      "Create Group": function() {
        var data = $('#add_group > form').serialize();
        var url = get_cluster_remote_url() + "add_group";
        ajax_wrapper({
          type: "POST",
          url: url,
          data: data,
          success: function() {
            Pcs.update();
            $("#add_group").dialog("close");
          },
          error: function (xhr, status, error) {
            alert(
              "Error creating group "
              + ajax_simple_error(xhr, status, error)
            );
            $("#add_group").dialog("close");
          }
        });
      }
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.