[Rails 2.3] named routes bug?

Hi,

I’m using this path :
admin_gallery_photos_path(gallery,session_key => cookies[session_key],
request_forgery_protection_token => form_authenticity_token)

log show :
Parameters:
{"_my_session"=>“BAh7CToMdXNlcl9pZGkGOhBfY3NyZl90b2tlbiIxMHk2T3luai9qUW1QditVaFdKS1hWbDVHS2ZtWWZuNFdVQ3BWNWdYaFNWND06D3Nlc3Npb25faWQiJWY4MjVmOTVlMWM1MGE5NmM2MzA0OGJkYzVhMzhlOTkxIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA–
a2b8debd77685e95a155b56d0b72de3fcb282d4f”,
“amp;authenticity_token”=>“0y6Oynj/jQmPv
+UhWJKXVl5GKfmYfn4WUCpV5gXhSV4=”}

why a “amp;” is add before authenticity_token ?