Man in the middle attack in 13w39b

With the new session server the serverID is no longer a sha1 hash with the public key and shared secret allowing an MITM attack to be preformed. See https://gist.github.com/thinkofdeath/d0fa2997886182b6a5ba for an example (in Go)