I know Cookieless sessions are a security risk, and that current MVC does not support them, but I need to support clients that want to wrap my app in an iFrame. All of my hunting for answers is yielding old blog posts and Stack Overflow answers from the early 2010's with hacks and work arounds that have largely been patched over and are no longer relevant.