What is the difference between cookies, sessions, and tokens?