diff --git a/ChangeLog b/ChangeLog
index 75f9e4e329..7e75c5fbb4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,12 @@
 Changes in version 0.2.0.21-rc - 2008-0?-??
-  o Minor bugfixes:
+  o Bugfixes:
+    - The control port should declare that it requires password auth
+      when HashedControlSessionPassword is set too. Patch from Matt Edman;
+      bugfix on 0.2.0.20-rc. Fixes bug 615.
     - Downgrade assert in connection_buckets_decrement() to a log message.
-      This may help us solve bug 614, and in any case will make its symptoms
-      less severe.  Bugfix on 0.2.0.20-rc.
+      This may help us solve bug 614, and in any case will make its
+      symptoms less severe. Bugfix on 0.2.0.20-rc.
+
 
 Changes in version 0.2.0.20-rc - 2008-02-24
   Tor 0.2.0.20-rc is the first release candidate for the 0.2.0 series. It
@@ -80,7 +84,8 @@ Changes in version 0.2.0.20-rc - 2008-02-24
   o Minor bugfixes (memory leaks and code problems):
     - We were leaking a file descriptor if Tor started with a zero-length
       cached-descriptors file. Patch by freddy77; bugfix on 0.1.2.
-    - Detect size overflow in zlib code. Reported by Dan Kaminsky.
+    - Detect size overflow in zlib code. Reported by Justin Ferguson and
+      Dan Kaminsky.
     - We were comparing the raw BridgePassword entry with a base64'ed
       version of it, when handling a "/tor/networkstatus-bridges"
       directory request. Now compare correctly. Noticed by Veracode.
diff --git a/src/or/control.c b/src/or/control.c
index fb4af9112b..3cc9c5fe2f 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -2541,7 +2541,8 @@ handle_control_protocolinfo(control_connection_t *conn, uint32_t len,
     char *esc_cfile = esc_for_log(cfile);
     char *methods;
     {
-      int passwd = (options->HashedControlPassword != NULL);
+      int passwd = (options->HashedControlPassword != NULL ||
+                    options->HashedControlSessionPassword != NULL);
       smartlist_t *mlist = smartlist_create();
       if (cookies)
         smartlist_add(mlist, (char*)"COOKIE");