Forget server side sessions... Use (encrypted) cookies instead! Freshly baked for each user.