A signed cookie is not object authorization

Signed cookies are great for integrity: the browser cannot silently rewrite a payload you sealed with...