Session isolation: The server gives each client a cookie and calls functions within their app environment. This means each user session looks like its own isolated thing.
These environments persist in memory but the server is smart enough to expire them or start dumping them really fast when memory gets low.