This is what sessions are for, maintaining volatile state that may or may not be written to a more permanent storage.

If your application stack does not have a session implementation that 'Just Works!'(tm) for you, you will have to implement one yourself.

Generally it will look something like a cross between your solutions 1 and 3, you create an opaque session key which is stored as a cookie and is used to retrieve the data from the session store. What you use to store session data is going to vary depending on how valuable the data and on how tragic failure is.

Avoid hidden fields in the html, they are a pain to maintain and will cause you problems because the temptation is to trust that their contents are what you put into them... it also means that you are repeatedly processing the same data. In sum; hidden form values make baby jesus cry.