Whole idea is that with opaque random number token requires having some database of valid tokens while this design does not. All data that this scheme exposes (

Whole idea is that with opaque random number token requires having some database of valid tokens while this design does not. All data that this scheme exposes (user id, cookie creation time) as plaintext are probably going to be exposed anyway by normal operation of application or in metadata of said cookie. Timestamp is protected by the HMAC (which may not be entirely clear from my previous description). And yes, the random number does not do anything significant and is probably useless. My reasoning was that it makes the structure of plain-text data slightly less evident from the cookie contents.