publish_session does not update the encryption key

[jcsp]

The following commit broke publish_session:

commit cf7e116796ccaf0aef76b4dad2b6c6908aee6d61
Author: Thomas S Hatch <thatch45@gmail.com>
Date:   Sat Jun 15 11:34:13 2013 -0600

    Set user of the running master

Specifically, in crypt.dropfile:

+    if user:
+        try:
+            import pwd
+            uid = pwd.getpwnam(user).pw_uid
+            os.chown(dfnt, uid, -1)
+            shutil.move(dfnt, dfn)
+        except (KeyError, ImportError, OSError, IOError):
+            pass

The shutil.move is inside the "if user" conditional. User is None when dropfile is used the call from master.py, so the .dfnt file is written but never renamed to .dfn, so the master never sees it and the key never gets updated.

This is an indirect security bug, if a deployment is relying on publish_session to increase the difficulty of attacks.

[jcsp]

Please consider this for backport as it is security related.