Environment variables are no good in this case, because they don't outlive the process in which they were created. A combination of cookies (session-ids) and database-based sessions is my preferred method of operation.