CGI::Session by default looks in the request parameters first for a session ID; it checks the cookie only if the parameters don't specify one. This is not desirable for Rails; most users do not use request-parameter-based sessions, and there is no best practice for doing so in Rails. This also opens Rails up to potential session fixation.
In the absence of a CGI::Session patch, I am attaching a patch that (by default) raises an error if a session ID is included in the request parameters. This behavior can be turned off (and thus reverted to the previous state) with the session option :cookie_session_id_only => false.
