IssueTracker

Currently, when using the API to perform logins with google accounts, an HTTPonly session cookie is set.

I believe that it would be good to set an extra cookie, accessible from client code, to be able to know from client-side that there is an existing session.

This would allow for more effective caching in a situation that I deem fairly common.

Use case:
Imagine a blog-like website. Logged in users can add new posts, and all posts are public.

Posts can be completely cached, both client and server side, but if we want to show different links in case of an active session (new post, logout, or login if there is no session) there is a need of server code re-creating the page and caches are made less effective.

Security status:
insecure transmissions already show the session cookie to an attacker intercepting the communication, this would not add more information.

Embedded websites would only know of the existence of a session (they could infer this from the presence of a "logout" link as well) and would not be able to access the session token.