If the userID is long enough (it is) and all the communication is https (it almost is), then you dont need anything else. It's not the most secure, but it's ac

If the userID is long enough (it is) and all the communication is https (it almost is), then you dont need anything else. It's not the most secure, but it's actually a pretty elegant solution. The userIDs are never used anywhere else, just as a cookie session ID essentially. They should have had them expire though. Your public key solution is definitely more secure and would accomplish hthat.