so as to prevent replay-style attacks.
Store state information and sensitive data on the server side only.
Ensure that the system definitively and unambiguously keeps track of its own state
and user state and has rules defined for legitimate state transitions. Do not allow any