Annie has just succeeded in stealing a secure cookie via a XSS attack She is able to replay the cookie even while the session is valid on the server Why do you think this is possible