UUIDs are wonderful: they're fairly small (16 bytes), and can be generated on multiple servers independently with no coordination. If you use version 4 or 5 UUIDs, the first couple of bytes are random, so short-circuiting comparisons should in theory bail quickly… but I've never had a need to measure.

Perhaps the only gotcha I've run into is that JS can't reliably generate them. (You need a decent RNG, and while JS has an RNG, no guarantees are made about it.) (Trivially work-aroundable with an AJAX endpoint on the server, of course.)