It seems like a signed / encrypted cookie would be a much better approach.