Question: what does forms authentication protect, as opposed to using session variable