Another approach to securing sessions without (much) SSL is SessionLock: http://ben.adida.net/projects/sessionlock/
Another approach to securing sessions without (much) SSL is SessionLock: http://ben.adida.net/projects/sessionlock/