I may be missing something, but what does it mean to "hold something in a session" if not to either
(1) store it in a cookie (encrypted or not) or
(2) store it server-side with a token stored in a cookie pointing to it?
I meant storing it on the server - just preferring not to have any actual cc data on the cookie, even obfuscated or encrypted. It may be a distinction without a difference, though, I honestly have never dealt with anything more complex than your basic 'hash username and password and check the hash when they login' scheme.
