A dirty-flag should be feasable here. Additionally, a checksum built from the session's attributes should be used.