Good, this way implementations are free to decide how cookies are used, if they're used at all. Alternatives could be HTTP headers, URL parameters, etc.