SvelteKit SSR auth example bug?

/**
   * It's fine to use `getSession` here, because on the client, `getSession` is
   * safe, and on the server, it reads `session` from the `LayoutData`, which
   * safely checked the session using `safeGetSession`.
   */
  const {
    data: { session },
  } = await supabase.auth.getSession()
  const {
    data: { user },
  } = await supabase.auth.getUser()
  return { session, supabase, user }

let session;
if (browser) {
  // using getSession() on the client is fine
  ({ data: { session } } = await supabase.auth.getSession())
}
else {
  // use the session from LayoutData, which verified the jwt via getUser()
  session = data.session
}