Use a newer cookie serializer

[dnrce]

Tracks isn't yet using the new config/initializers/cookies_serializer.rb that shipped with Rails 4.1. See http://guides.rubyonrails.org/upgrading_ruby_on_rails.html#cookies-serializer

[lrbalt]

I do not see exactly what needs to be changed here. We do not store much in the cookie anyway. Do we need this?

[mattr-]

If I understand that guide correctly, the JSON cookie serializer is an optional thing.

[dnrce]

It's a minor security improvement. I also imagine the old serializer will eventually be removed, though not anytime soon.

[lrbalt]

could you pick this one up? or do we schedule it for 2.4/3.0?

[dnrce]

2.4 would be good. It would be good to do one release with the hybrid serializer as a transition, then JSON-only on the next one.

[lrbalt]

The hybrid serializer is already on, right? So nothing todo for 2.3?

[dnrce]

No, it stays on Marshal until the hybrid serializer is explicitly enabled. The hybrid reads Marshal cookies and writes JSON cookies. It provides a clean transition for end users, but the application needs to be validated for JSON cookie compatibility before enabling it.

Let's go hybrid for 2.4 and JSON for 3.0.

[ZeiP]

This was apparently done in #2145. Changing from hybrid to json should be done later on.