They're implying that you are storing state in the client which sends that state back to your system in subsequent requests, e.g. an HTTP cookie. If doing so, make sure to use a MAC [0] to tell if the client has tampered with the state you stored.

[0] https://en.wikipedia.org/wiki/Message_authentication_code