Add security against stolen-cookie attacks, add user existence check.