Personally, unless security is of absolutely no concern, I wouldn't suggest using cookies. Here's an example of what I've done in the past, from a previous node entitled Administration Ignorance

While I'd be the first to admit that this method is a bit more complicated than cookies, it has enough advantages that I think it is probably worth the little bit of extra programming.