Earlier quoted context omitted.
Really good point. Even better, I'd really like these cookies to be digitally signed (like Rails' session cookies are by default), so that they're unforgeable. Seems like it wouldn't be too terribly hard to add to nginx...hmm... ;)
They should be secure random strings, no need to sign. BTW, rails signed session cookies are terrible from a security perspective. Thank god Github has moved away from them.
What, in particular, is problematic about them? Do you mean their particular implementation, the fact that they aren't also encrypted, or the general "password equivalent in a cookie" concept overall?