Two parallel builds, running of physically separate machines where the impersonation build has all writes turned off. Live build uses OAuth for authentication, impersonation build uses AD for authentication + HTTP cookie for impersonated person ID. All logged out the wazoo. This is in the financial industry.