Moreoever, I think it's good security practice to have multiple layers instead of always relying on 1 mechanism. We have https and the cookie itself is encrypted so we could say we don't need this option. But I don't thing it would hurt to do that. I would be in favor of this.