can users change session variables?

Question

Or are they only manipulated by the server? For instance, can we always assume that Auth.User.Id always corresponds to the current user?

Answer 1

Session variables are always kept and protected at the server. When using PHP's default implementation at least. So yes, as long as its set right.

Only a unique ID identifying the session is sent to the client.