There is no risk that a client cheats by using an item name dedicated to another client, because the Metadata Adapter can validate the request against user information in getItems.
For the same reason, you don't need to have the client use client-specific item names, because you can decorate the item names with client information in getItems (despite we opted for the former technique in the Messenger demo).

On the other hand, thanks to the level of decoupling offered by getItems, we choose not to provide session/user information to the Data Adapter.
The Data Adapter has to find all the information needed to determine the item meaning packed in the item name it receives through subscribe
and it is the job of getItems ensuring that the item names are composed in the proper way.