fix NEWS: a Windows "sid" is a security ID, not a session ID