Add some notes on hashing the cookie