What are you using guys to authorize and track your users? (encrypted:) cookies or sessions?

I think you're asking about authentication, not authorization. Are you asking whether the cookies are compared to server-side state (as with sessions) or contain authentication information that only the server can encrypt and decrypt?