I (almost) agree. That would be actually nice, if I had control of the requirements / specs. At the moment I have to check the feasibility of the other option, regardless of the known side efects (performance, static pages,...)..
If I cannot do that, it's fine. But I need to be sure I can't achieved that (for example, looks like there are some setting in Bea and Tomcat to disable cookies but I wonder if the same result can be achieved programmatically, I don't like to be you vendor dependent)