Support Cookie Authentication Validation allowing Customizations

I’m wanting to be able to extend the functionality of our community with some javascript and need a way to verify user when connecting to our backend service (running on subdomain of CC) as getting the UserId from inSidedData is to easy to fake as UserId’s are sequential.

My suggestion would be to have a api endpoint that can verify the session cookie and return userId. 
an alternative might be secret token or something on InsidedData that is long enough to not guess and can be retrieved by api.

Usecase:
allowing per product product update subscription.
so we create UI replacing the subscibe button allowing for granular subscription that sends to backend service to persist the settings(no way to do so to user profile could also be an option)
We then use webhooks to capture new product updates and email all users subscribed to the categories.