There's nothing wrong with unconditionally calling CGI::Session->new(). If you provide a CGI object (or no arguments at all) it will take the session ID from the cookie, if any, and load the corresponding session.

Only if that fails it actually generates a new logical session.