Then connect the browser directly to the secure element of the device, so the session cookie is cryptographically signed by something you are physically in possession of.