note 88123 deleted from function.session-start by cmb

Note Submitter: philippe dot latulippe at xxxxgmail dot com ---- When using session_start() with cookies over an encrypted connection (like HTTPS) it is important to set php_ini('session.cookie_secure',true). This sets a flag in the cookie which will stop browsers from sending this cookie over an unsecured connection. If this is not done, a Man-In-The-Middle could easily cause the victim's browser to send his session ID in plaintext, gaining access to the account and defeating the goal of the secure connection. http://fscked.org/blog/fully-automated-active-https-cookie-hijacking