Custom visitor group criterion state storage in Epi 10

I want that visitors can see content only if the URL contains a specific key and value in url-parameters, for example `?clienttype=business`.

For that i have created following classes.

Setting class:

[EPiServerDataStore(AutomaticallyRemapStore = true)]
[PublicAPI("Used in module episerver vistorgroups")]
public class UrlParameterValidationSettings : CriterionModelBase, IValidateCriterionModel, ICriterionSettings
{
    public CriterionValidationResult Validate(VisitorGroup currentGroup)
    {
		if (string.IsNullOrWhiteSpace(Key))
		{
			return new CriterionValidationResult(false, $"{nameof(Key)} must not be empty");
		}
		if (string.IsNullOrWhiteSpace(Value))
		{
			return new CriterionValidationResult(false, $"{nameof(Value)} must not be empty");
		}
		return CriterionValidationResult.Valid;
	}
	public override ICriterionModel Copy()
	{
		return ShallowCopy();
	}
	public string Key { get; set; }
	public string Value { get; set; }
	public bool IsDeny { get; set; }
}

Criterion class:

[VisitorGroupCriterion(
	Category = "Custom Criterion",
	DisplayName = "URL-Parameter exists with a given value",
	Description = "Checks if a URL-Parameter exists with a given value")]
public class UrlParameterValidationCriterion : CriterionBase<UrlParameterValidationSettings>
{
	public override bool IsMatch(IPrincipal principal, HttpContextBase httpContext)
	{
		NameValueCollection requestParameters = httpContext.Request.QueryString;
		string value = requestParameters[Model.Key];
		bool matchingUrlParameter = value != null && StringComparer.InvariantCultureIgnoreCase.Equals(Model.Value, value);
		return Model.IsDeny ? !matchingUrlParameter : matchingUrlParameter;
	}
}

It works. But now i want that it will be validated only once and then keeps it value the whole browser-session. Currently it seems that it checks the url-parameter on every request. 

Even if i use the builtin "Visitor Group Membership" and add there a custom visitor group with the above criterion, it will always validate it on every request.

Is it a misunderstanding on my side how visitor groups work, or what is the correct way to implement this requirement? 

We are still on EPI 10 but will switch to 11 soon. Is this change in EPI11 what i am looking for or is it already possible in 10?