Right, the persistence mechanism will be injected as the cache layer. So that leaves us with 3 possible kind of authenticator services (so far):

* One that uses cookies for ID plus a cache layer for persistence;
* One that uses cookies for ID and persistence;
* One that doesn't use cookies, but a signed hash (HMAC).