you missed one method: Storable.pm. (if you're using OO-data). you can freeze an object, pass it as a hidden parameter, and thaw the 'stringified' object on the next invocation.

more secure than some, because if the stringified object is tampered with, it more than likely won't thaw properly, and session data is lost.