This tutorial on sessions may be a good place to start: http://expressjs-book.com/forums/topic/express-js-sessions-a-detailed-tutorial/

Here's the gist of it: The session lives on the server. The cookie on the user's agent tells the server, "Oh BTW, this is my 'account number', you can reuse my settings from the last request I made." The cookie value is really just a key which the server uses to identify the session. The "secret" nature of the cookie just makes it a little less likely that 3rd parties will get access to that session key -- this is what is referred to as a "hijacked session".

Sessions are commonly used in more old-school web applications (think e-commerce site keeping track of a shopping cart), but less so in HTTP APIs. The issue with APIs is that storing user-specific state in the server changes the representations of the resources without changing the URL, which pretty much invalidates the cache. We can go over this concept in more detail offline if you are interested.