There should be a file for each session. Sessions are not dependent upon a user being logged in or not. Usually, someone visits the page (calls your cgi program), and session is created. Unless you do cleanup, the session will hang around forever.

Also, you shouldn't be guessing, or taking my word for it, you should be testing (and making notes) instead :) for example see Re^3: CGI::Session - expiry, Re: CGI::Session Question

So, question one, how sustainable is this?

Well, file system limits are very real, too many files, and enumerating files (readdir) slows down noticably, its one of the reasons CPAN uses the id/A/AU/AUTHOR scheme (git uses a similar scheme).

You can adopt this scheme by subclassing CGI::Session::Driver::file and splitting directories based on sessionid (and while you're at it, you can omit cgisess_ as a filename prefix).

(OT) should i limit number of files in a directory, Efficient processing of large directory, Perl solution for storage of large number of small files, Comparison of file systems

Could I do this somehow without forcing all users to log in again?

You're a programmer aren't you? :D