Generally your MITM scenario won't work. You won't have access to secure cookies to pass along in the attack. I do agree though if you can spoof arbitrary cook

Generally your MITM scenario won't work. You won't have access to secure cookies to pass along in the attack. I do agree though if you can spoof arbitrary cookies, I don't see how you are secure from MITM attacks.