Can sensitive information be saved in req.session.user cookie?

Hello,

Can information be securely stored in `req.session.user` for example in the [login script](https://github.com/erikras/react-redux-universal-hot-example/blob/master/api/actions/login.js)? For example would it be acceptable to store a user's name, email, password, userid, etc.? Or could this information ever be maliciously accessed? How can I authenticate if they're really logged in? Could they ever manually set this information? Do I need to setup a tokening system?

Trying to understand this simplified API example.

Thanks!