It might not actually be that intrusive. As long as you have acceptance of cookies as a condition in your Terms of Service, you can say that the specific permission to store cookies is granted whenever the user signs into their account.

Heck, you could even write that as a separate provision (e.g. "In order to sign you in, we'll need to store a cookie in your browser") and it wouldn't be all that intrusive.