Add a session id to the URL and all generated links, I'd guess. Still probably not any more legit than a cookie, though.

I wouldn't be surprised if that fell under "similar devices", just like localStorage.

generate a random ID in js when your page starts, set it in the context and send it as a header on every request