I have casually come across this link: Basic Web Session Impersonation: a good reading, the more so if you're new to the field of securing web applications.
Ant9000