with json RPC, we need the connection cookie, so no way to cache user_id and avoid login