[dcow]

I found Big Cookie. I mean seriously sitting in-front of you is a proposal that’s objectively better than session tokens in a cookie jar, where the nonce portion could be entirely optional at the expense of allowing replay attacks, and you call it a non starter. You’re just looking for reasons to not be secure at this point.