Description:
------------
If I set session.use_trans_sid to 1 and form=xxx is included in url_rewriter.tags, a hidden input field with the session-ID is added to every form. It seems to me that the output handler doesn't care if the action-attribute of the form is an absolute URL as it does when rewriting URLs. So, the session-ID is sent to foreign sites.

Reproduce code:
---------------
ini_set('session.use_trans_sid',    '1');
ini_set('url_rewriter.tags',        'a=href,area=href,frame=src,input=src,form=action,fieldset=');

...

if (strlen(session_id()) < 1)
      session_start();

...