13. A system, comprising: a computer-readable storage medium having instructions stored thereon; and a device including one or more data processing apparatus that execute the instructions to cause the one or more data processing apparatus to perform operations comprising: receiving an input method editor (IME) server request, the IME server request including one or more tokens and requesting that an IME server be instantiated, the IME server executing one or more IME functions based on a key event sent from an IME client, wherein the IME server is a stateful server that stores both requests and responses of a communication session between the IME server and the IME client; determining that the IME server is authorized to be instantiated in a restrictive environment based on the one or more tokens, wherein each of the one or more tokens corresponds to a respective restriction level of functionality provided by the restrictive environment; instantiating the IME server in the restrictive environment in response to determining that the IME server is authorized to be instantiated in the restrictive environment based on the one or more tokens; responsive to instantiating the IME server, generating a randomly generated path name for communication between the IME client and the IME server, wherein the path name comprises a named pipe; storing the path name in a user profile directory, wherein access to the user profile directory is enabled by verification of a security token provided by the IME client; generating a unique session identifier (SID) for a session associated with a user at the IME client; and transmitting the unique SID to the IME client using a connection that is established based on the path name.
13. A system, comprising: a computer-readable storage medium having instructions stored thereon; and a device including one or more data processing apparatus that execute the instructions to cause the one or more data processing apparatus to perform operations comprising: receiving an input method editor (IME) server request, the IME server request including one or more tokens and requesting that an IME server be instantiated, the IME server executing one or more IME functions based on a key event sent from an IME client, wherein the IME server is a stateful server that stores both requests and responses of a communication session between the IME server and the IME client; determining that the IME server is authorized to be instantiated in a restrictive environment based on the one or more tokens, wherein each of the one or more tokens corresponds to a respective restriction level of functionality provided by the restrictive environment; instantiating the IME server in the restrictive environment in response to determining that the IME server is authorized to be instantiated in the restrictive environment based on the one or more tokens; responsive to instantiating the IME server, generating a randomly generated path name for communication between the IME client and the IME server, wherein the path name comprises a named pipe; storing the path name in a user profile directory, wherein access to the user profile directory is enabled by verification of a security token provided by the IME client; generating a unique session identifier (SID) for a session associated with a user at the IME client; and transmitting the unique SID to the IME client using a connection that is established based on the path name. 18. The system of claim 13 , wherein the IME server request is generated by the IME client, and the IME client is a stateless IME client that stores only requests that the IME client issues to the IME server.