This should use `cookies.signed` too, so people can't ship things to someone else.