That's quite interesting. Don't forget to make sure you have the secure flag set on your cookies, that way you won't send the cookies over non-SSL connections.

You should also set the HttpOnly flag, which implements some XSS-limiting features, dependent on the browser.

While you're looking at securing session management, it's probably worth looking at Cross-Site Request Forgery:

http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(C...

Some frameworks, such as Django have Cross-Site Request Forgery protection built in for free. The OWASP site linked earlier is an invaluable resource for all things web application security, and is definitely worth bookmarking.