Document that source cookies are currently not encrypted

Mostly flagging this is a known issue that should not be re-reported to
us in hopes of a bounty.

Author: legoktm

securedrop/source_app/session_manager.py

@@ -43,6 +43,8 @@ def log_user_in(
         )
 
         # Save the passphrase in the user's session cookie
+        # TODO: this is not encrypted and is recoverable client-side by anyone with
+        # access to the cookie. This is known and tracked at <https://github.com/freedomofpress/securedrop/issues/204>.
         session[cls._SESSION_COOKIE_KEY_FOR_CODENAME] = supplied_passphrase
 
         # Save the session expiration date in the user's session cookie