Maybe it would be more appropriate to call the cookies-only implementation `CookieAuthenticatorService`. I must correct myself: this is not a "client-side" implementation. It's still server-side. It's just that it stores all authentication information in the cookie.

So probably the diferentiation factor is this, i.e., where the auth information is stored:

* CacheAuthenticatorService: Stored in the cache, uses cookie for ID.
* DatabaseAuthenticatorService: Stored in a relational database, uses cookie for ID.
* RedisAuthenticatorService: Stored in Redis, uses cookie for ID.
* MongoAuthenticatorService: Stored in MongoDB, uses cookie for ID.
* CookieAuthenticatorService: Stored in the cookie.
* HMACAuthenticatorService: Derived from [a secure hash](http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/).