Session variables is a hard topic to crack. After looking at what the above mentioned module has provided consider:
- who do you want to make responsible for tracking your sessions?

If it's the user, then give them a cookie with the state information you need. E.g. username/password.

If you want something that will work regardless of cookie support on a browser then a session key is required, and you'll have to store that somewhere, presumably a database that you have. Then you give the user the session key attached to every URL they might click on, or embed it as a hidden field into every form you create.

Sessions are tricky! Good luck..