Yahoo warns that a forged cookie by a 'state sponsored attacker' may have been used in 2015 or 2016 to illegally access accounts.