Hacker News Reader

I think the point is that the debug is leaking sessionid cookies, which could be transplanted into your browser to fake a session.

I think that these are bound to the user's own session, which is already in the browser cookie.