Core openid module also affected

OpenID doesn't seem to work for us after enabling this module, likely because openid.module shows several references to $_SESSION. That's only mildly inconvenient for the site in question, but perhaps OpenID could be added to the list of affected modules on the project page.