Reuse token-free message controls and render posting deliveries once

app/controllers/concerns/authentication/session_lookup.rb

@@ -1,7 +1,7 @@
 module Authentication::SessionLookup
   def find_session_by_cookie
     if token = cookies.signed[:session_token]
-      Session.find_by(token: token)
+      Session.eager_load(:user).find_by(token: token)
     end
   end
 end

app/controllers/concerns/cached_responses.rb

@@ -47,8 +47,6 @@ module CachedResponses
         return yield unless encoding
 
         key = response_cache_key(encoding)
-        original_session = session.to_hash.deep_dup
-
         return yield if key.bytesize > ResponseCache::MAX_KEY_BYTES
 
         entry = ResponseCache.instance.read(key, @response_cache_version)
@@ -57,6 +55,7 @@ module CachedResponses
           ResponseCache.instance.synchronize_render(key, @response_cache_version) do
             entry = ResponseCache.instance.read(key, @response_cache_version)
             if !entry && ResponseCache.instance.version == @response_cache_version
+              original_session = session.to_hash.deep_dup
               yield
               rendered = true
               entry = cache_completed_response(key, original_session, encoding)

app/controllers/messages_controller.rb

@@ -28,7 +28,9 @@ class MessagesController < ApplicationController
     set_room
     @message = @room.messages.create_with_attachment!(message_params)
 
-    @message.broadcast_create
+    # Both deliveries contain the same token-free, viewer-independent markup.
+    @message_html = render_to_string partial: "messages/message", formats: :html, locals: { message: @message }
+    @message.broadcast_create(html: @message_html)
     deliver_webhooks_to_bots
   rescue ActiveRecord::RecordNotFound
     render action: :room_not_found