Experts warn that authentication cookies have become more valuable to cybercriminals than passwords, allowing attackers to hijack online accounts without logging in.