posted 13 years ago
Step 3 is crucial - the server tries both cookies and URL rewriting. By the time the second client request comes in, there are two possibilities:
a) it contains a cookie - the server can henceforth use the cookie, and doesn't need to perform URL rewriting
b) it does not contain a cookie - the server must continue to use URL rewriting, since cookies are not used by the client