Storing IDs in session cookies is not something the Rails framework introduced. Smh. It's easier to blame someone else's code though.