Although there are no guarantees there, what you are likely getting is people logging in very recently because their POST request is still in memory. If you we

Although there are no guarantees there, what you are likely getting is people logging in very recently because their POST request is still in memory. If you were just logged in with an old session from a few hours ago, it's unlikely your PUSH request will still be in memory. But every time you connect you are sending a cookie which allows for session hijacking.