How does Redmine keep track of session?

Is it done with cookies? Which gems/code is involved?
Are they cached somewhere and how are they indexed/retrieved when somebody does a POST or GET?

I'm having log in issues and need to track down why user information is getting into cookies that
it does not belong in. I believe there is an indexing/caching issue

Thanks in advance
S~