And also the convenience of having the user/session info in HTTP headers where all sorts of other code/frameworks expect it -- instead of only where Flash in-page objects can see it.

Ah, I see now! Really tricky...