add a TODO note about a MAC for the session cookie

via http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html
(I will work on this someday)