I'm sure I'll get flack for this but isn't a session cookie passed with every request essentially the same as passing an Auth header with every request? In eit

I'm sure I'll get flack for this but isn't a session cookie passed with every request essentially the same as passing an Auth header with every request? In either case HTTP is still stateless.