> Wasn't the question about using them for auth, not application state?

Whether a user is auth'd or not can indeed be a form of application state