Whilst you're no doubt right, from my reading and understanding, that can be frought with possible vunerabilities. I'd prefer to use a module for the low level stuff thats proven (thats why people go to the trouble of writing them).
The question is, does it matter which one? I'm leaning towards CGI::Session, but I'm not sure.