The forged-cookie test is a good one to include. On the 4 queries per load: wrapping getSession in React's cache() inside one small data access function lets the layout, page and any server components in the same render share a single lookup. The proxy runs outside that render so it still pays its own, which is another reason to keep it to an optimistic redirect.