[1.6.x] Clarified session replay attack differences with cookie backend.

Backport of 00a0d3de02 from master