Model should be agnostic as to whether we're using cookies. Rename to "createPersistentSession"?