If they're able to sniff/steal your cookie they can easily capture any other request headers. This wouldn't be the case for brute forcing cookie values, but ho

If they're able to sniff/steal your cookie they can easily capture any other request headers. This wouldn't be the case for brute forcing cookie values, but hopefully your cookie is secure enough to make that a non-issue. AOL, and a few others, unfortunately still break the "IP for session security" thing:(