This is a very good point, that some of the "identifiers" (session, cookie,
whatever) should have a similar life cycle as security credentials (where
passwds are a valid instance of server side authentication).
>
> Shopping carts embedded in ids is a cute hack, but it's a red herring. The
> real goal in my mind is to find a way to identify a user without requiring
> them to carry a separate ID for every store they walk into.
It seems to me that a "user centric" view of the web would call for
client side generation of the credentials, that could be reused
at many different storefront businesses.i.e. shopping at a mall
rather than a department store for one stop shopping.