But... aren't headers also encrypted? Won't the "Date: Thu, 27 Jun 2013 14:20:43 GMT" header make it unlikely that there will be more than x000 copies of the exact same data encrypted?
The key stream is generated independently of the plaintext, so the attacker really only cares that the bytes he's interested in (i.e. session cookies) stay at the same offset in the stream.