They can't run with "Recreate Session" enabled, which thus leaves the store vulnerable to session hijacking.