You need a datastore anyway to prevent replay attacks.