ServiceStack uses a HTTP cookie and supports a variety of authentication options out of the box, including basic auth.
https://github.com/ServiceStack/ServiceStack/wiki/Authentica...
We also use the easy hooks that ServiceStack offers to validate API developer / app tokens as well.
Social Bootstrap API is a backbone example:
https://github.com/ServiceStack/SocialBootstrapApi
https://github.com/ServiceStack/ServiceStack.Examples
http://stackoverflow.com/questions/15862634/in-what-order-ar...
It also has various other goodies, such as:
https://github.com/ServiceStack/ServiceStack/wiki/Metadata-p...
https://github.com/ServiceStack/ServiceStack/wiki/The-IoC-co...
https://github.com/ServiceStack/ServiceStack/wiki/Plugins
https://github.com/ServiceStack/ServiceStack/wiki/Clients-ov...
It also doesn't require ASP.NET and can run on Unix under Mono.
Try it, you won't go back to WebAPI is guarantee it!