Thanks. That seems risky if one's client is stateless, but I understand it's a compromise.