Client script service callback and user data

I have been writing internal web services with javascript client interfaces for a while now.  Normally, on a internal setup, I would in my page load event put the user's ID into a hidden field on the client where the client would then pass that userID back to the server in its script service call to tell the server whom is making the request.

 In the case of an external site, one would need only change the hidden field ID or call the web service with someone else's ID to essentially impersonate that user.

 Does anyone have a pattern to fix this issue?  I can think of a number of ways to solve this issue such as forcing the user to use cookies and making them check the login on every page.  While this might work, the roundtrip could be painful on page loads.

Thanks a million for your help.
...