This is only possible if you store client state, like the primary email address. I use the same approach to the above, where users authenticate with an email a

This is only possible if you store client state, like the primary email address. I use the same approach to the above, where users authenticate with an email address. I don't store any client state on the server though which is nice for regulations like GDPR. I have 'logged in' users without storing a single piece of data about them! No tracking nor performance stats on the site either.