> Where would you set them, instead of a secure cookie?

I supposed the claimed email could be stored in session storage which would give it dialog lifetime.  I don't know enough about how things are put together to know whether that would be viable.