Last one sounds the most promising, if clients (rather than base stations) can be uniquely identified, and often enough to be practical. I know that base stations send a beacon out x times per second, but phones probably don't.