The idea was that requests may concurrently change the session state. But you're right, using a single cookie simplifies this and makes the session more secure, so I'll rewrite it.