Phi offers included session support. You find the available parameters in the page settings dialog in the Meta tab. You can define a special page in Redirect, which is loaded if the session is timedout. If you want to set also a session cookie (called phisid) check the Set session cookie box. Session keys are automatically available through $PHIPOST[phisid], $PHIGET[phisid] or if set through $PHICOOKIE[phisid].