Use client-sessions package to store user ID (and other state we are forced to keep) in encrypted cookies