There's nothing wrong with storing sessions in a database. If you have a cluster of servers, it's the simplest way to go.