There is a problem with trunk's CAS ID allocation where it doesn't allocate a new ID after a CAS.
This means that it would correctly validate the CAS ID on save, but not create a new one, so the previous CAS ID could be replayed indefinitely (which means that if n clients try an update at the same time, they'll all succeed).
I've attached two diffs:
1) A test case that shows it allowing CAS replay.
2) A fix for #1.
cas-fix.diff
Description: Binary data
cas-test.diff
Description: Binary data
-- Dustin Sallings
