Where I work we use something simple like kerberos/basic/digest/custom http header authentication on our apps, and then put Apache with mod_auth_form in front of it (or ISA server).
I even wrote an authentication reverse proxy[1] in java in my spare time, so I can use that to publish my apps, and have SSO across all of them (until BrowserID becomes mainstream that is). This way I centralized the cookie auth problem, and don't need to care about it in every app.