Salt used for cookie-based sessions isn't consistent with module name

[Julien Phalip]

The salt used for dumping/loading cookie-based sessions is 'django.contrib.sessions.backends.cookies':

https://code.djangoproject.com/browser/django/trunk/django/contrib/sessions/backends/signed_cookies.py?rev=16466#L92

https://code.djangoproject.com/browser/django/trunk/django/contrib/sessions/backends/signed_cookies.py?rev=16466#L36

It'd make more sense if it were 'django.contrib.sessions.backends.signed_cookies' to reflect the actual module name.

[Luke Plant]

Changing this would break everyone's signed session cookies. This feature was added since 1.3, so we are still allowed to change it, but we might not want to for the sake of those following trunk.

The possibility of a future clash here is pretty minimal - it would only happen if we also add a django.contrib.sessions.backends.cookies module, which presumably would be a cookie backend without signing (what would we want that?), and then also change our mind and use signing with it after all!

[Julien Phalip]

Yes, this "problem" really isn't a huge deal. If we don't make the change, then at least a comment could be added in the code, explaining that the inconsistency was kept for "backwards compatibility" reasons.

If one uses trunk in production then one should be aware that they're exposing themselves to occasional breakages. For that we reason then we could allow ourselves to make the change before 1.4 gets released.

[Jannis Leidel]

Actually this was fixed as part of r17101 (#17223).