Whenever you're ready, walk me through how you'd approach this.
How would you mitigate risks associated with cookie-based authentication?