bigfix tracking cookie , only sent right before we try to handle each request.

apiV1login.go

 	}
 	//log in user
 	if u.Id == ss.User {
-		*ss = trial //we are the same
+		e = ss.LogInUser(u.Id)
+		if e != nil {
+			log.Error("Cannot Load authenticated user:", u.Id)
+			apiV1Server500Error(w, r)
+			return
+		}
 	} else if !ss.IsEmpty() {
-		ss.ReuseAsUser(u.Id, ss.Expire)
+		ss.InitForUser(u.Id, time.Now().Add(loan.DefaultSessionDuration))
 	} else {
-		ss.InitForUser(ss.User, time.Now().Add(loan.DefaultSessionDuration))
+		ss.InitForUser(u.Id, time.Now().Add(loan.DefaultSessionDuration))
 	}
+	//enforce machine id
+	ss.Add("mid", apiV1GetMachineId(r))
 
 	res.add("auth", ss.Token)
 	res.add("session_id", ss.Id)
 	res.add("session_user", ss.User)
 	res.add("buser", ss.User)
 	res.add("bpass", ss.CheckSum())
+	res.add("mid", ss.Get("mid"))
 	//send out
 	res.sendJson(w)
 }

apiv1.go

 		return
 	}
 	session.RenewIfExpireSoon()
-	session.SetRemote(r) //make sure they are using latest remote
+	session.SetRemote(r)                     //make sure they are using latest remote
+	session.Add("mid", apiV1GetMachineId(r)) //set machine id
+	apiV1AddTrackingCookie(w, r, &session)   // add tracking cookie to client
 
 	//we have a session now, either guest or valid user
 	//search through handler
 	apiV1DumpRequest(w, r, &session)
 }
 
-func apiV1InitSessionByBrowserId(w http.ResponseWriter, r *http.Request, session *loan.Session) {
+func apiV1GetMachineId(r *http.Request) string {
 	var mid string
 	inCookie, e := r.Cookie("mid")
 	if e == nil {
 	} else {
 		mid = strconv.Itoa(int(time.Now().Unix())) + "-" + gofakeit.UUID()
 	}
+	return mid
+}
+
+func apiV1InitSessionByBrowserId(w http.ResponseWriter, r *http.Request, session *loan.Session) {
+	mid := apiV1GetMachineId(r)
 
 	var sid string
-	inCookie, e = r.Cookie("session")
+	inCookie, e := r.Cookie("session")
 	if e == nil {
 		sid = inCookie.Value
 		if sid != "" {
 			session.Add("mid", mid)
 		}
 	}
+}
 
+func apiV1AddTrackingCookie(w http.ResponseWriter, r *http.Request, session *loan.Session) {
 	//add tracking cookie
 	expiration := time.Now().Add(365 * 24 * time.Hour)
 	cookie := http.Cookie{Name: "session", Value: session.Id, Expires: expiration}
 	http.SetCookie(w, &cookie)
 
+	mid := apiV1GetMachineId(r)
 	cookie = http.Cookie{Name: "mid", Value: mid, Expires: expiration}
 	http.SetCookie(w, &cookie)
 

main.go

 	ar.Env.Session.Bin = []byte("masked data") //clear
 	ar.Env.Session.Secret = "***********"
 	ar.add("Body", dumpLines)
+	ar.add("mid", ss.Get("mid"))
 	b, _ := ar.toJson()
 	fmt.Fprintf(w, "%s\n", b)
 }