Try using CGI::Session. Its easier than rolling your own.

If this isn't an option, than erasei's idea of expiring sessions is the way to go.