From this Drupal advisory: When
contributed modules such as Workflow NG terminate the current request
during a login event, user module is not able to regenerate the user's
session. This may lead to a session fixation attack, when a malicious user
is able to control another users' initial session ID. As the session is not
regenerated, the malicious user may use the 'fixed' session ID after the
victim authenticates and will have the same access.
