Comment by jacobsenscott

Giving your cookies short timeouts, say 5 minutes, and including the client's ip address in the cookie are both mitigating techniques.