  def cama_current_user
    return @cama_current_user if defined?(@cama_current_user)
    # api current user...
    @cama_current_user = cama_calc_api_current_user
    return @cama_current_user if @cama_current_user

    return nil unless cookies[:auth_token].present?
    c = cookies[:auth_token].split("&")
    return nil unless c.size == 3

    @cama_current_user = current_site.users_include_admins.find_by_auth_token(c[0]).try(:decorate)
  end
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."