Oh, say, you know, I pretty much missed the point of your OP. Sorry. Putting the params in the redirect URI should work fine if the length isn't crazy (<= 2K I think works on most browsers). Probably best to take them out of request->body_params if it's a post form. It won't preserve file uploads but everything else should work. Since it's just for testing I don't see any problems with this.

Oh, actually I'm still being stupid. Check out Catalyst::Plugin::Session::PerUser. I haven't had a chance to try it yet but it's probably just the ticket.