What about something like this? http://substack.net/offline_decentralized_single_sign_on_in_the_browser http://substack.net/offline_decentralized_single_sign_o

What about something like this? http://substack.net/offline_decentralized_single_sign_on_in_the_browser http://substack.net/offline_decentralized_single_sign_on_in_... Edit: This article describes a solution that uses an appcache manifest with a far-future max-age that stops the browser from refetching the application code. It then uses an alternative mechanism to load updates presumably with a future option capable of verifying the legitimacy of the code with some sort of public key infrastructure ala Microsoft's Authenticode.