oh, these are all stored in a cookie? ... what about separate devices? or users who clear their cookies after a session, or using private browsing?

storing this all in a cookie scares me, personally. it may be because I don't have enough context, though.