I know the full analysis isn't online but I have a problem with this part... > This was done out of an abundance of caution, after we received one (1) user rep

I know the full analysis isn't online but I have a problem with this part... > This was done out of an abundance of caution, after we received one (1) user report of being logged in as someone else. This _seems_ like a knee-jerk reaction to one data point. There could be other causes for a user to report that, like a change to the cache key used for serving a users profile giving the _appearance_ that you're logged in as someone else, even though you're not really. Forcing everyone to re-login could potentially make the system worse, in that you're now overloading parts of the system that has to handle those logins, plus causing all kinds of cache expiry... I guess there's more to the story and someone who knows the system deeply knew this was the right choice but just reading the reports it seems knee-jerkish.