> eliminating the need for the painful session/state maintenance across multiple nodes If session/state maintenance across nodes is painful, the solution isn't

> eliminating the need for the painful session/state maintenance across multiple nodes If session/state maintenance across nodes is painful, the solution isn't to trust the web browser, it's to make such maintenance much less painful. For example, you can use a cache server (like ehcache) to store session state. Or you can use smarter load balancers (like haproxy) to minimize node hopping. A cookie is an authentication credential, just like a username and password combination. If you can't invalidate an authentication credential on the server side, your solution is an instant fail.