We presently have 1 instance of the server, but we plan to put additional servers out so we have 1 each in the U.S., U.K., and Australia. It is unlikely we'll need to cluster though.
After the user logs in, on an https connection, what's the best way to verify that on subsequent requests it is the same person? Can we assign an object to the https session and safely assume that session remains that client user and they will stay tied to the particular server they logged in to?
Or do we need to do something additional?