can users change session variables?

Or are they only manipulated by the server? For instance, can we always assume that Auth.User开发者_如何学Python.Id always corresponds to the current user?

Session variables are always kept and protected at the server. When using PHP's default implementation at least. So yes, as long as its set right.

Only a unique ID identifying the session is sent to the client.