I have a client (vanilla JS) that communicates with the server (Node.JS) via Sockets.io. My task is to verify the identity of the user before the server will do anything to the resources (DB in particular) on command from the client. I also need to save the user's session for some time. I have made a scheme (attached) as far as I understand the implementation path. Is it the right (secure) way?