php cookie behaviour changes in recent versions

[Eman]

I have a website written in-house, using a 3rd party login mechanism.Recently we've been required to maintain PCI compliance, and I made a lot of changes in the environment. Shortly after we noticed a problem with cookies. I've rolled back all of the changes except the more difficult one of moving from php 5.3 back to 5.2.11, or whatever it was.Here's what's happening. For our own internal administration I had written a login page that would take the user's name and password as a query string, The admin page for each user would have a 'become' link that would let us log in as that person. The page would overwrite the cookies of the admin with the cookies of the user, and we're THEM. As far as I know, it didn't delete any cookies first, just overwrote. It worked, until recently. Yes, insecure, but it's internal, please forgive me.Now when we follow the links, our admins are staying admin. The only way to become a customer is log out, then type in their username/password.The other thing I've noticed is that there's cookies set for each sub directory of the site, where before I think there was only one for the site itself. But I'm NOT positive that this has changed, there may have been subdirectories before...So, I'm hoping the problem lies in a way that PHP is handling cookies in 5.3, either by not overwriting existing cookies any longer, or creating directory specific cookies instead of site wide.Any ideas?