Thanks Sam.  The code in there is actually pretty much what I have, and that too does not persist the login after the browser is closed.

Sorry for the late reply here.  A cookie is created "login-token" but it's a session cookie, so when the browser closes out, the cookie also goes bye bye.  I need to change this to keep the cookie.

It's just using the standard AEM login by posting to j_security_check.  We don't have anything custom in the login what so ever.

I have a site where a user logs in and the request object is authenticated, i can also see that the user is authenticated by checking the CQ_Analytics object and checking the user profile data to see that isLoggedIn is true.If the user closes their browser and navigates back to the site, the request...

I don't exactly know that I understand what you're saying about the user drag/drop, impersonation piece, but from the perspective of using it in a service to create/read/etc, you shouldn't have any issues.  The only restriction that i'm aware of is that only the "admin" user has access to the CRX Ex...

You can create a user and assign it to the administrative group and use it's credentials rather than the default admin user.You may also want to take a look at this article which goes over using the correct resource resolver in AEM 6.