You should maybe try using hidden fields to maintain state. Just throw in a little unique ID for the user. There is also a little, less secure idea. You could throw the user's password and ID in the the hidden fields too...but I would definately NOT recommend this. There could also be a problem with this though, too. If someone doesn't always access something through a form (like a hyperlink) then it will not work and the user will be logged out.
Overall, you should probably set a little mix between the two to get the best of what you want. Hope I helped :)