    public function refreshUser(UserInterface $user)
    {
        $user = $this->inner->refreshUser($user);

        $alterUser = \Closure::bind(function (InMemoryUser $user) { $user->password = 'foo'; }, null, class_exists(User::class) ? User::class : InMemoryUser::class);
        $alterUser($user);

        return $user;
    }
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.