Clarified session replay attack differences with cookie backend.