I'd also consider Cache::Cache, which is what I use for session management.

Personally I dislike the API of Apache::Session (not being a huge fan of tied hashes). CGI::Session manages the session IDs for me, and I usually want to manage them separately from the persistance layer.