[http-state] Security considerations overview

[Adam Barth <[e-mail]>]

Rather than have a blanked "cookies are bad" statement at the
beginning of the security considerations section, Tyler suggested that
we overview the main security issues with cookie (of course, providing
details later in the section).  Here's a first draft of an overview
section.

      <section anchor="section-overview" title="Overview">
        <t>The cookie protocol has a number of security and privacy
        pitfalls.</t>

        <t>In particular, cookies encourage developers to rely on ambient
        authority for authentication, often creating vulnerabilities such as
        cross-site request forgery.  When storing session identifiers in
        cookies, developers often create session fixation
        vulnerabilities.</t>

        <t>Transport-layer encryption, such as HTTPS, is insufficient to
        prevent a network attacker from altering a victim's cookies because
        the cookie protocol does not provide integrity.  By default, cookies
        are transmitted in the clear, where their confidentiality can be
        compromised by a network attacker.</t>
      </section>

Adam