more magic
using client-side sessions