annie has just succeeded in stealing a secure cookie via a xss attack she is able to replay the cookie even while the session is invalid on the server why do you think this is possible?