In case user deletes that flash cookie, but forgets to clean the http one!
And also the convenience of having the user/session info in HTTP headers where all sorts of other code/frameworks expect it -- instead of only where Flash in-page objects can see it.