If they are logged in, then you can continue to use supertokens' session to ID them. Else, you can use the random ID you had put in their cookies.