correct, it sends back a page confirming that login has been successful. * together with a cookie containing a random session ID that coincides with. * a session .