authorization with socket.io
===

I'm attempting to determine how best to authorize (in addition to authenticate) a user to perform a specific task using socket.io. 

In express, this is fairly straightforward. I first have a login/password form that queries the database to determine if the record exists, and if it does exist, then I attach the User to the req.session data. 

    exports.session = function(req, res){
    	User.authenticate(req.body.username, req.body.password, function(err, user){
    		if (user){
    			req.session.user = user;
    			res.redirect('/');
    		} else {
    			console.log("authentication failed");
    			res.render('user/login');
    		}
    	});
    };

And once I have this, I can use middleware to authorize certain requests. For example, 


    app.put('/api/users/:userId', m.requiresLogin, m.isUser, api.putUser);

    //Middleware
    exports.isUser = function(req, res, next){
      if (req.session.user._id == req.user._id){
        next();
      } else {
        res.send(403);
      }
    };

But I'm a bit confused about how to do this using socket.io. Say I have a event listener which alters a user's profile in the database, given that user's profile JSON object. 

        socket.on('updateProfile', function(data){
        // query the database for data.user._id, and update it with the data attribute
        // but only do this if the data.user._id is equal to the user trying to do this. 
        });

Any suggestions as how to achieve this? Can it be done through the session information? 
