Protecting Cookies with Device Bound Session Credentials