"3. This is really the tricky part as an attacker can wipe browser cookies at will."

No need for an attacker, I do wipe them at will. Every time I close the browser.