A session id is a name for a conversation. Before you sign in, the conversation is with nobody in particular; afterwards it is with you. The defect is keeping the same name across that change.
It matters because an attacker can give somebody a session id. A link, a subdomain, an old cookie — the mechanisms vary and they all end the same way: the victim signs in on an id the attacker already knows, and the attacker is now signed in as them.
POST /sessionSend this with a session cookie of your own choosing, then compare the id each build sends back.
The fix is one call, and it is one call because the framework offers both — authenticate keeps the id, rotate mints a new one. A handler that reads perfectly well can be using either.
This is the shape of most authentication defects: not a wrong algorithm or a broken check, but the right function's near-neighbour, called in a place where the difference only shows up under an attack nobody wrote a test for.