Question: Play framework security issue regarding cookies and sessions