You can give them a token in a cookie. It's not as efficient, but it can still work.