title: Why does ServiceStack authentication use cookies rather than a sessionId header?
body: <p>I'm loving using ServiceStack, but one question has come up from a colleague that I cannot answer. The Authentication mechanism sets a <code>ss-pid</code> and an <code>ss-id</code> cookie, which is explained here: <a href="https://github.com/ServiceStack/ServiceStack/wiki/Sessions" rel="nofollow">https://github.com/ServiceStack/ServiceStack/wiki/Sessions</a></p>
  
  <p>When trying to access a restricted resource, these cookies need to be provided, otherwise you'll receive a <code>401 Not Authorized</code> result.</p>
  
  <p>My question is this. Why use a cookie rather than a custom HTTP header value that includes the <code>sessionId</code> or equivalent cookie values? Is it because the cookie inherently has its own mechanism to maintain expiration? What were the design decisions undelying the use of cookies over HTTP headers?</p>