How do you steal session cookies without having access to an end user device (in which case you could steal passwords and short lived cookies just as easily)?