Do they expect a user to re-enter their password every time they click a button on a website? Without requiring cookies how do they expect a session to persist between pages?