Worse: “SCS doesn't address replay of old cookie values.”