Gitblit is vulnerable to session fixation

Originally reported on Google Code with ID 62

```
From the gitblit forum:

Gitblit accept url like
http://example.com/gitblit/;jsessionid=8EB3144A6XXXXXXXXX
and jsessionid doesn't change when user login.
So session fixation seems to be possible.

http://en.wikipedia.org/wiki/Session_fixation


```

Reported by `James.Moger` on 2012-02-09 13:28:59
