Issue #2378699 by klausi, David_Rothstein, pwolanin: Port session hijacking fixes from SA-CORE-2014-006 to Drupal 8