\motivation{HS:  This may be redundant with the standards-track HTTP
state maintenance mechanism \cite{rfc2109}.  The equivalent way of doing
this would be for the server to send {\tt Set-Cookie:  Session="123";
Version=1; Path = "/twister"} and for the client to return later {\tt
Cookie:  Session = "123"; \$Version=1; \$Path = "/twister"}.  In the
response to the TEARDOWN message, the server would simply send {\tt
Set-Cookie:  Session="123"; Version=1; Max-Age=0} to get rid of the
cookie on the client side.  Cookies also have a time-out, so that a
server may limit the lifetime of a session at will.  Unlike a web
browser, a client would not store these states on disk. To avoid privacy
issues, we should prohibit the Host parameter.}
