In this (Is it possible to use Experience Manager Session Preview without the Ambient Data Framework?) post, Will Price explains how you can work with XPM if you host the ADF in a data service (which gets called by your web app) rather than in the web app itself.
The key is to pass a 'Preview Session Token' from the web app to the service. I have seen this working in 2013, where the token is contained in a cookie called "preview-session-token". But in 2011SP1, this cookie does not appear to be set. I do see a cookie 'TAFTrackingId' but I doubt if that is it.
How can I pass the preview session token to a web service in Tridion 2011 SP1?