Here is my approach. Build a table of extended sessions. Use unique encoded session flags. Something like storing the original session id with some minor encryption, along with a date time stamp. The length can be relative or absolute, say it expires the day that the test ends or give them a week to complete it.
Cookies is the answer, but keep it secure and do give it a timeout.
The first solution that doesn't pass around login and password info. Search Copyright 1999-2001 INT Media Group, Incorporated All Rights Reserved.