Cookie-Less Logins

Okay, I'm a little stumpe don this one. I've got a PHP3/MySQL site that users will log into so they can update their account info. Security does not have to be on-line bank/credit card tight, but I don't want to just keep passing their username and password as hidden input fields. I also don't want to use cookies. So far this is the best I've thought of.... Have a MySQL table that contains sessionid, username, and time. Pass the sesisonid from one page to another throughout the site either in hidden INPUTS or as part of an <A HREF=....> Each page will query the database to find the username and check to see if the sessionid is more than 1 day old. If it's too old, it's deleted and they have to log in again. I see 2 drawbacks to this: 1. For 24 hours, jsut knowing the sessionid enables anyone to pretend they're someone else. 2. If a client wants to bookmark a page, they'll have to re-log in whenever they go to it. Keep in mind that this is an information site, not e-commerce. Any tips out there??? Thanks, Jeff Gannaway