This is a 'best practices' question. (UPDATED for clarity)

I am trying to find the best way to make my browser-side code adaptive to user attributes, like whether the user is authenticated, an admin, or has certain attributes.

I am creating a static application. For some valid reasons, I cannot have the pages rendered by the server. They need to be static; the same pages are served to everyone; so a solution where the server renders pages isn't feasible (please take that as given for the sake of this question).

All of the security of this application is server-side. All served pages and routes are access-managed by express and passport, verifying authentication from the cookie sent by the browser, and redirecting to /login when authentication fails. So this isn't about moving security to the browser side; I very much am implementing security server-side; this is about how to present state to the user.

I am using express-session to store the session id in a cookie. By default, it only puts the session id in the cookie, and marks it httpOnly, so I can't access it from browser code.

I modified the config of express-session to turn off httpOnly, so I can now see the cookie on the browser via javascript, but it is still just the session id.

What I'd like to be able to do is attach additional, specific information to the session cookie so my pages can decide what to show/hide based on this information.

So the question comes down to:

How do I get express/passport to pass a session cookie with additional, specific user attributes, and how do I read it on the client?