it's actually not. the connect-cookie-session change happened in https://github.com/mozilla/browserid/pull/3980 which is already merged. So, connect-cookie-session should correctly not be in the lockdown anymore.