[0xfffff]

Correct, it doesn't. If you grab that cookie and then pass the cookie from somewhere else it will work.

Section 7.2.3 talks about cookie theft.

[kerng]

Yeah, as others have pointed out this RFC is from 2013 - so a bit dated.