Just to play devils advocate. There could be some security advantage in using cookies rather than some other mechanism for storing user state information. It

Just to play devils advocate. There could be some security advantage in using cookies rather than some other mechanism for storing user state information. It could reduce the attack surface.