content: The way they have set up the session authentication, the session token is encrypted. It is impossible for evilsite to steal a session. All they are saying is its up to the user to make sure they are authenticated on the correct website so they don't give out personal info. Agreed there is  a  flaw to this but session stealing is not possible.