webservice logon state

hi,
I have an application which requires users to log on via a webservice method.  Once they are logged on (via a database password check) a unique ID is kept on the web service in a list, and also given to the client.
Whenever the client calls other webmethods, it sends accross its unique key in an authentication header.  My problem is that sometimes, after a period of time, the collection of keys on the web service seems to be getting cleared, even though the list is in a static class.  This gives all the clients an error message telling them they have been logged out.
I have read in places that this might be because IIS recycles app domains occasionally?  Is the best method just to turn off recycling?  How is this achieved?
Any ideas on this would be greatly appriciated!