This can also protect the server from attacks if it runs all sessions in isolation. All you can is click and type, no more sqli or xss that require messing with

This can also protect the server from attacks if it runs all sessions in isolation. All you can is click and type, no more sqli or xss that require messing with params or API. So it could be useful either way.