Update user callout api to utilise both db persistence and cookies

The following discussion from !121282 (merged) should be addressed:

• @dstull started a discussion:

  note (non-blocking):

  It would be great if we could have the best of both worlds, a user callout framework that could:

  1. handle persistence (db)
  2. handle not signed in users (cookie based)
  3. handle back button (db doesn't handle back and so cookie might help that)