@uwo Well, the client can alter the cookie unless you HMAC it. I guess you could use it for settings, but typically you’d use the session.

@weavejester thx!