[pjungwir]

It is relevant to this:

> I . . . decoded _gist_session cookie (which is regular Rails Base64 encoded cookie)

In Rails 4 the session cookie is encrypted with a server-side secret, so the end user can't decipher it.

[kneath]

Gist is indeed running Rails 4.

[steveklabnik]

Isn't gist an entirely separate application from dotcom? My impression was gist is a Sinatra app, not Rails.