[kerng]

Pass the cookie attacks are problematic (e.g in case someone already has root access, which is the concern here).

Hacker will just wait until after auth and steal your cookies.