I may be missing something, but what does it mean to "hold something in a session" if not to either (1) store it in a cookie (encrypted or not) or (2) store it server-side with a token stored in a cookie pointing to it?

I meant storing it on the server - just preferring not to have any actual cc data on the cookie, even obfuscated or encrypted. It may be a distinction without a difference, though, I honestly have never dealt with anything more complex than your basic 'hash username and password and check the hash when they login' scheme.

That means holding the credit card information on the server. Seems safer to hold it temporarily on the client.