Even that is often not enough: sessions are long lived and very often stealing a cookie is all the attacker needs.