I noticed during some testing using UserState that each time I opened webchat it would pull down the same state object in each instance.

Webchat uses "default-user" as the id for all anonymous users which means all users will share the same user state. This seems like a security risk.

Can we change to use a random user id for all anonymous users?