Fair enough, although for this particular application, security is not a real issue.

The problem is that sessions aren't persistent through page loads due to having a load balanced server. There is also the issue of pop ups killing the session in IE. I am trying to work out a two birds, one stone approach ;(

Do you know of any workarounds for this that don't involve using cookies? I certainly prefer sessions all things equal. But I certainly can't be having a user authenticate on each new page ...