> as the encrypted cookie can be sniffed, and replayed to the server

I think the whole article is premised on requiring a level of security that would presume TLS is being used.