Some half-baked thoughts about cookies.

Hey folks,

https://github.com/mikewest/http-state-tokens suggests that we should
introduce a client-controlled, origin-bound, HTTPS-only session identifier
for network-level state management. And eventually deprecate cookies.

I think there's a conversation here worth having, and this group has
thought a lot about the space over the last decade or two. I'd appreciate
y'all's feedback, both about the problems the document discusses with
regard to cookies as they exist today, and about the sketchy proposal it
advances about managing HTTP state in the future.

Thanks!

-mike