Drop session_start() from Your Paywall: HMAC-Signed Cookies and Single-Use Recovery Links

session_start() does not just lose a paywall purchaser when the browser closes — it kills page...