[Solved]Where to store user info after logging in

[eluser]arcreative[/eluser]
Not to spoof an authenticated session--as an attacker isn't going to get the reply packets...

But while I'm here, it should probably be mentioned that IP matching is finicky in situations (especially mobile browsing) where the IP can change on a per-request basis. CI will drop the session every time the IP changes, so this should be considered when building your application!