Now and then you forget some small detail that has you running in circles trying to figure something out. In my case it was an authentication cookie not being persisted. After trying a few options, I realised that a list of claims were being persisted in the user data parameter! Of course, a cookie can only be 4096 bytes 😉