Find out if the HttpOnly flag is set in cookies.

Find out if you can use a small extension to an existing component to implement the system.

Find out if form variables are available to store data.

Find out if you need to use session-based indirection.