The main problem with the session is that it gets stored on the harddrive.

I've though about it before and using an in-memory cache seems like the best idea (I'm no security expert though)