The core idea

The server remembers you; you hold a ticket.

After login, the server stores your session and hands you a random session ID. You send that ID with each request to be recognized.