Is this valid even if you use session instead of cookie?