"HTTP cookies, or how not to design protocols" -- excellent read. http://bit.ly/cuCscV