Or fall back to a session cookie?