able to replay the cookie even while the session is valid on the server