Actually, selecting an item in the menu does only that, it doesn't call set_session() at all. It's when something else call set_session() than a check is done about the menu items (to see if it exists, and set it active if needed). And set_session() with an item is actually only ever called by start_authentication() is called.
That means nothing can set a state variable, unless a callback is added to the menuitems, which might be possible, although I'm not sure how to do it.
Actually, selecting an item in the menu does only that, it doesn't call set_session() at all. It's when something else call set_session() than a check is done about the menu items (to see if it exists, and set it active if needed). And set_session() with an item is actually only ever called by start_authentic ation() is called.
That means nothing can set a state variable, unless a callback is added to the menuitems, which might be possible, although I'm not sure how to do it.