You can do signed cookies, validate in your lambda function the credentials, and then return a signed cookie. A little dirty, but quick and enough to lock-down