Yes, that would be a great approach, and here is why:
If you aren't passing that data back and forth with every apache server interaction, you do not make that data vulnerable to the threats of form cracking or man-in-the-middle sniffing.

As I recall, CGI::Session handles this out of the box, but the primary vulnerabilities left becomes cracking your session ID and injecting bad data through th form fields. Don't make your session IDs sequential or otherwise easily guessable and you protect your application and your users from that threat, as well. As for the injection of bad data, FormValidator is useful.

-- Hugh