Okay i did it with a field on the user and it seems to work.
I guess the user “thing” is effectively my session data space?