Unless I'm mistaken, isn't this just adding a few more bits of randomness to your random number? > When the cookie does not contain the username, you, the serv

Unless I'm mistaken, isn't this just adding a few more bits of randomness to your random number? > When the cookie does not contain the username, you, the server, need to look up in your table to whom you gave the random number. When the cookie does contain the username, I have to look up whether that random number is valid for the given username. How is that better?