yeah, that was the impetus around my PR night before last related to IdentitySession. Feels icky here. Would rather have the IdentitySession have responsibility for that data, along with the other stuff in there, that really is the user's identity...