In theory they could use something like a session cookie to keep the server-side session intact when page navigation happens. I think I would prefer that over injecting something like Turbolinks or limiting this to SPAs.