After page reload and cookie clear, the user magically remains authenticated, but how?

Glad you have it now!