Remove incorrect hijacking comment.

http://stackoverflow.com/questions/26927741/why-cant-the-yesod-session-cookie-be-hijacked