@gamecreator
I believe Josh just queries the Steam for who is currently logged in. I don't think Josh is then verifying that the logged in user, is really who Steam says they are.
So anyone could potentially have an app running on the same local port as Steam does, that responds to the same calls, and fakes a logged in user. Without some sort of backend verification of tokens you can't really know if a user is who "Steam" says they are.