CGI::Session or a database are the conventional ways of storing information pertaining to a session or a user. Using a cookie (which CGI::Session manages for you) or some get data embodied in the URL is generally the way you track a session.

The trick is to use a key (in the URL) that provides access to the server side stored information for the session. Often an MD5 hash of something like a user ID and login time is used to provide the key.