Securing web services with PHP sessions (and not passing the logged in username via POST anymore)