hmm, I don't know... I was thinking in use something like `backend.logged_in()` or something... And do not access things like tokens or session ids.