1. A method, comprising: providing, with a hardware computing device, at least one of two security framework configurations, wherein a first configuration utilizes a cookie and a second configuration utilizes server-side storage; performing user authorization, with the hardware computing device, using at least one of the two security framework configurations, wherein performing the user authorizations with the cookie includes providing a cookie stored on the hardware computing device and the server-side storage includes storing developer-defined user information (DDUI), wherein the DDUI comprises at least a user identifier for on-demand database service; wherein when using the cookie to perform user authorizations, each time a user makes a request the cookie is sent for authentication purposes to provide re-authentication with each request, wherein either the user is recognized because the cookie or a session context containing a security token was provided, or the user is not recognized and diverted to a security handshake, or a token request is utilized to obtain a session identifier, API endpoint and authentication token; wherein when using the server-side storage, the hardware computing device is configured to not write locally to an application memory, but instead to access a shared session cache, where each of a plurality of servers are to be given access to a specific session cache; and wherein performing the user authorizations is done through a client web application executed by a hardware computing device to allow access to an on-demand database service.