IdP cookie protection

[Peter Schober]

* Chad La Joie <lajoie at itumi.biz> [2012-02-23 15:22]:
> The cookie isn't considered part of the public API so there isn't any
> documentation of it outside the code itself.  That said, the
> protections in place are:
> - normal cookie domain/path settings
> - user-agent address checking
> - cookie content signatures using a server-side, per-session secret key
> - randomly generated sessions IDs

- flagging them "secure" (might go under "normal cookies settings",
  though not domain/path related)

-peter