rather say "safe session cookie" otherwise user could think this is related to https transmission of the cookie (see setting below)