[java-sig-commits] [Bug 1069919] CVE-2014-0033 tomcat: session fixation still possible with disableURLRewriting enabled