Joe....what is to prevent a "devious sort of soul" from simply, applying different random numbers, within the parameters of the "cookie ID" noting the name and thereby assuming identities....other than the original one????

It appears to be one of the simpliest of "hacks" possible.