In an earlier post, I menionted the Tech Note describing the security risk of using session-based cflogin. The recent Updater fixes this, although for some reason it was not mentioned in the release notes. I got an official confirmation of this a few minutes ago.