13.05.2016, 09:39
You are wrong.
They can spoof connection cookie request, but they cannot spoof full final connection (step 2).
They can spoof connection cookie request, but they cannot spoof full final connection (step 2).