But that doesn't answer the question... a session cookie is not a problematic thing to add... certainly it's used in nearly every other login system in the known universe...
You say you have "squashed the bug" but the only bug is the lack of a seemingly vital feature.