This change looks correct to me.

2 requests come by at the same time with tokenA:

• the one that wins the race persists and sends back tokenB
• the other one accepts tokenA but doesn't send any cookie back, aka tokenB from req 1 stays in the cookie jar.

Unless I missed something, this still fixes the situation that@heiglandreas describes in#46760 while preventing a needless disclosure of the currently valid token to the 2nd request.

/cc@Seldaek in case you want to have a look.

I'm just worried that although this causes a possible security threat,the security disclosure process hasn't been followed appropriately. Please be more careful in the future.