Javascript ES2015 etc...

[galt57]

With the massive changes being made to browsers for ES2015 are there also any improvements being considered in the way that browsers maintain state? Static session cookies are just too vulnerable and certificated https will never be universally used. Everyone agrees that JS would be a unreliable hack for security, so why can't the browsers do something better?