[homakov]

Cookie tossing are not always helpful. If session is properly tied with csrf token there's not much you can do with it.