Use hybrid session cookies, at least for now