Describe the user identification flow via Verigram: the user opens the page — what happens next, how is the session and token obtained?