Yea, use sessions. Thats how i do it and its how arti does it also. Its the way to go.

You could use cookies but those are easily editable. So they might be able to just switch accounts really...