Do these urls require authenticated sessions to get to them? Is there anything of value protected by these sessions? Otherwise, I don't see much point in stealing cookies (which is pretty much all...