We could have also used server-side session IDs tacked onto URLs to maintain state. Probably need to add some sort of "only valid for this IP/timestamp/user ag

We could have also used server-side session IDs tacked onto URLs to maintain state. Probably need to add some sort of "only valid for this IP/timestamp/user agent" checks internally to limit session replay abuse, but likely a solvable problem.