The same key can be used for each session...when the Gmail page is being generated, I am saying this embedded in-line key can be associated TO the user's cookie, so that there is a one-to-one correspondence between this "Javascript cookie/session variable" and the user's actual cookie. There is no problem whatsoever. The only thing to be done is the exact same authentication that Google has to do to determine from which authenticated user chat requests are coming from (or any other AJAX request sent to Gmail).
EDIT: To answer your question of "are they doing some kind of lookup for each AJAX request?" Well of course, since they already have to look up a user's ID, account information, etc. based on the cookie they send.
EDIT: To answer your question of "are they doing some kind of lookup for each AJAX request?" Well of course, since they already have to look up a user's ID, account information, etc. based on the cookie they send.