session id written to browser - initial socket connection responds with session id which loads full user on server - avoids dumping full user record to browser
login loop