By storing it in a cookie - oh :-) I suppose you could come up with some scheme where you create a new cookie with every request, a kind of one-time cookie to

By storing it in a cookie - oh :-) I suppose you could come up with some scheme where you create a new cookie with every request, a kind of one-time cookie to prevent session hijacking. Probably not worth it and not 100% reliable, though. I guess just trusting in cookies is the only real option. Or HTTP BasicAuth, it sends the password with every request I think (unencrypted, I know). In either case in theory you need HTTPS.