If you will work with sessions, then init this at first in your plugin, theme.
add_action( 'init', 'my_start_session' );
function my_start_session() {
if ( session_id() )
return;
@session_cache_limiter('private, must-revalidate'); //private_no_expire
@session_cache_expire(0);
@session_start();
}
Alternative use the library from Eric Mann: WP Session Manager, also his tutorial.