> Servers must ... make DB calls to verify the user is still active

I'm not being facetious, genuinely asking - is this a big deal? Should be a pretty cheap query, and with pooled connections, hardly any overhead.