[Rails 2.3] named routes bug ?

Hi,

I'm using this path : admin_gallery_photos_path(gallery,session_key => cookies[session_key], request_forgery_protection_token => form_authenticity_token)

log show : Parameters: {"_my_session"=>"BAh7CToMdXNlcl9pZGkGOhBfY3NyZl90b2tlbiIxMHk2T3luai9qUW1QditVaFdKS1hWbDVHS2ZtWWZuNFdVQ3BWNWdYaFNWND06D3Nlc3Npb25faWQiJWY4MjVmOTVlMWM1MGE5NmM2MzA0OGJkYzVhMzhlOTkxIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA-- a2b8debd77685e95a155b56d0b72de3fcb282d4f", "amp;authenticity_token"=>"0y6Oynj/jQmPv +UhWJKXVl5GKfmYfn4WUCpV5gXhSV4="}

why a "amp;" is add before authenticity_token ?