The mbox3rdPartyId is the approach favored by most of the organizations I work with, given the APIs available to push/pull data for it. Additionally, that approach creates a dependency on the visitor service, which may not be available if you do server-side testing and don't move the service server...