I am developing a website using ASP.NET MVC with an API using ServiceStack.

Very soon I want to add authentication. The website will have at least two types of users 'service providers' and 'service consumers', although a user could have multiple roles.

I am open to using new MVC Identity, but I want whatever I use to work nicely for both the servicestack API and MVC 'pages' that don't necessarily use the API but should show different content based on login. I do not want to **require** javascript for login/logout.

I would like the solution to use tokens as I have not used session state anywhere else, but I am open to other options providing they would scale horizontally on a cloud provider (users next request may go to a different instance of back-end).

Anyone have example of an ideal solution?

(N.B: I am not interested in an externally hosted service).