Currently experimenting with WebSockets to develop a real-time/stateful authentication/authorization APIs (User/AuthSession models). WebSockets work fine with desktop clients (always on network connection). Where WebSockets fall down is with mobile clients (network connection isn't always on) since the WebSocket session can easily close at any time (with little warning), and there would need to be a way to easily establish a session again.