Correct, it doesn't. If you grab that cookie and then pass the cookie from somewhere else it will work.

Section 7.2.3 talks about cookie theft.