private function setSessionCookies(AuthenticationRecordInterface $authentication)
    {
        $systemKey = new EncryptionKey($this->systemEncryptionKey);
        $sessionKey = new HiddenString($authentication->getSessionKey());
        $userKey = new EncryptionKey($sessionKey);
        $hashCookieName = hash_hmac('sha256', $sessionKey . $authentication->getUsername(), $systemKey);
        $userTuple = base64_encode(Crypto::encrypt(new HiddenString($authentication->getUserId() . ':' . $hashCookieName), $systemKey));
        $hashCookieContents = base64_encode(Crypto::encrypt(new HiddenString(time() . ':' . $authentication->getUserId() . ':' . $authentication->getUsername()), $userKey));

        //
        // 1 - Set the cookie that contains the user ID, and hash cookie name
        //
        $this->setCookie(
            self::COOKIE_USER,
            $userTuple
        );

        //
        // 2 - Set the cookie with random name, that contains a verification hash, that's a function of the switching session key
        //
        $this->setCookie(
            self::COOKIE_HASH_PREFIX . $hashCookieName,
            $hashCookieContents
        );

        //
        // 3 - Set the sign cookie, that acts as a safeguard against tampering
        //
        $this->setCookie(
            self::COOKIE_VERIFY_A,
            hash_hmac('sha256', $userTuple, $systemKey)
        );

        //
        // 4 - Set a sign cookie for the hashCookie's values
        //
        $this->setCookie(
            self::COOKIE_VERIFY_B,
            hash_hmac('sha256', $hashCookieContents, $userKey)
        );
    }