The programmers tell them that this is the way the protocol is supposed to work, so there is no real way around it without recoding everything to use cookies, registration, headers, and other stuff, which will make the marketing department look bad for not giving good requirements in the first place.