Unauthenticated account takeover via predictable session encryption

Authentication bypass in User Session Synchronizer 1.4.0 and earlier allows remote attackers to take over any account via crafted requests. On every request, synchronize_session() accepts attacker-controlled ussync-key, ussync-token, and ussync-ref values without nonce, capability, or shared-secret validation; an unknown key makes both option lookups false, reducing the AES key to predictable md5('') and the referer check to an empty-string match. No prior authentication or site secret is required, and a known or guessable email lets the handler issue an authentication cookie for that user, including an administrator.