To compare with the browser cookie
well yeah but it doesn't store them like the browser does, in the sense that the client can't just set arbitrary cookies on a request to the server and expect it to store them right?