Keeping sessions alive across page loads

A sign-in attempt can finish successfully and still leave the browser without a session. The result has to be turned into cookies before the next page load can see it.

After an attempt completes, the SDK fetches the access token and writes the session cookies on the server. From then on, middleware can verify the session on every request.

Session and client cookies can legitimately fall out of sync. The middleware checks for signed-in, signed-out and mismatched states, and reconciles a mismatch with a redirect.