actually it is a not a further input, it is written in the help file.. Please read it
Don't worry about cookie/session issue: If user is using cookies, it will use cookies, if user is a session user it will use session. Bottom line is it is completely safe and unpassable on user side regarding of his cookie settings.. Basically it uses the same mechanism vb forum permissions uses. So if you set a userid or usergroupid in your cantsee list, there is no way he can see that webtemplate..