I have a simple nodejs app that oAuths in the backend and sends out sessionId to the front-end. Which then goes on to create a "Lightning-out" component. But accessing session Id on client side seems unsecure to me. A hacker can use it. Is there was to just inject lightning component from backend to front end without revealing any authentication detail at-all , including session Id?