Verifying secure session…

httpOnly cookie + local mirror for instant UI.