Having to do account recovery to recover the cookie is a perfectly valid technical response I guess. However since cookies are invisible, and account recovery

Having to do account recovery to recover the cookie is a perfectly valid technical response I guess. However since cookies are invisible, and account recovery is normally a big scary thing, it boils down to this: (a) the end user has lost something invisible that they didn't even know they had (b) the method of recovering the invisible token is to go to what is probably the last place they are going to look a + b = full retard // and you should never go full retard