Indeed! Someone should make a browser API that lets services direct the user agent to set domain-scoped key value pairs that are passed back to the service on subsequent requests. That would let the client automatically prove that they're authenticated while maintaining the server-side statelessness.

That sounds like the old Unix 'magic cookies'.. maybe we should call the things 'cookies'!

Obviously no. What it would make it different than another user accessing the same account then?

HTTP is stateless so, no.