Verifying secure session…
httpOnly cookie + local mirror for instant UI.