Comment by bottled_poe

Session variables are awful, which is the main selling point for cookies. I prefer basic auth with server-side user settings. This is how I implement stateless web apps and services, which greatly simplifies application architecture and makes it easy to implement automated atomic web testing.