I explained I don't have infrastructural experience in setting them up, but I did go onto explain that this could be achieved by storing session data in a database, and by use of a token stored in the cookie. Again, not the textbook answer, but provides insight I would have thought.