in that they are cryptographically generated ids with an expiration attached to them that the user agent must stick in a header on every request.