title: Are all session variables sent over HTTP?
body: <p>I like the idea of a so called session-ID, which is sent to the browser and returned back for auth. But can I store more data in serverside session variables, for subsequent sessions to access? I'm using PHP.</p>