This doesn't seem to protect from Pass the Cookie attacks.<p>Edit - it's a common red teaming tactic:
<a href="https://wunderwuzzi23.github.io/blog/passthecookie.html" rel="nofollow">https://wunderwuzzi23.github.io/blog/passthecookie.html</a>