Cookies would work after the initial login. I just wanted to see if there was a way to do it, without having them login ever. Because they've already authenticated on the domain, I don't need to repeat the step of authentication.
It looks like I'm going to have to initially reauthenticate them, and then use as you suggest....the cookie.