Allow stateless authenticator to generate affinity cookie

Some authenticators are stateless (ex: CMIS Basic Auth) but clustered implementations would still benefit from a pseudo-session cookie being generated so that the load balancer can use affinity to always hit the same server in the context of a given client.