After page reload and cookie clear, the user magically remains authenticated, but how?

Ah, so true! How did I not think of the cross domain cookie?!
Thanks very much.