I've been developing web applications for 15 years and I've lost count of how many times I've built some form of sessions. I learnt some neat tricks from this article (mixing signed cookie sessions for logged out users with database backed sessions for signed in, having a revoked_at field) that I hadn't used before. Definitely worth an up vote.