James58899
says to
YSITD
cookie不是都只塞session的hash