>Session cookies can be reset much more easily than asking a user to reset their password. This statement is making an assertion about the behavior of vastly d

>Session cookies can be reset much more easily than asking a user to reset their password. This statement is making an assertion about the behavior of vastly different software backends and the skill-set of the people administering the systems. Things that may appear trivial to you may not be for the sysadmin in charge of servers running healthcare applications that have an opaque internal state.