In his example, where the server maintains the state of the basket, all the requests from the user require a user name and password which will be used to authenticate the user and thus prevent identity forging.