OAS 4.0 - 'Client sessions=ENABLED/DISABLED' parameter

KEYWORDS: session-enabled cartridges, 'Client session' parameter (ENABLED/DISABLED) PROBLEM: User requests web page from OAS by a web browser. When he send the next request - OAS doesn't know that it's he again. :(

IDEAL SOLUTION: User ID stored on server in a session-scope variable (starts to exist when client session starts, retain it's value till the client session dies - after specified idle time ).
That solution is simple implemented in Microsoft's ASP by a 'session' object that has scope of session and in which you can put any data you want - so simple.

EXPLANATION: After ASP we moved to OAS with PL/SQL cartridges (at least trying to ...) to use advantages of ORACLE OAS, but ...
I'm still trying to find the most convenient solution for this problem in OAS. :(( (two weeks of searching solution passed already)

It seems to me that the best clue is to start with 'Client sessions=ENABLED/DISABLED' parameter
that can be reached at:
OAS manager: website->Applications->MyApplication->Configuration->Web Parameters

My QUESTION is:

1. Does somebody knows what this parameter means and does and can it be used for solving problem described above ?

Should be simple, and I heard many suggestions that I'm thankfull of, but noone gave me this simplest and most efficient solution that I believe exists:

Cookies are no good.
Hidden fields are no good because they are not safe (user ID is stored on client - is not good ).

Transactions are not very convinient because they make me to begin and commit/rollback transaction with exactly specified URI, that is very, very inconvenient. No mentioning that I don't need (such) transactions at all - i just need to memorize data associated with client session.
I found these text in OAS docs:
"You can think of stateful transactions as being similar to session-enabled cartridges. The difference is that in a stateful transaction a

     client is associated with a cartridge instance only for the duration of a transaction, while in a session-enabled cartridge, a client is

     associated with a cartridge instance until the session times out, or when the cartridge ends the session. "
So it gives me the hope that session-enabled cartridges are the solution, but there is nothing in OAS documentation how to use them.

If you know anything about session-enabled cartridges and 'Client session' parameter I would very appreciate to give me some hints, references where to look or even explanation of solution.

thanks in advance,

Vedran

--
B.Sc. Vedran Kesegic
Faculty of Electrical Engineering And Computing
University of Zagreb
CROATIA