It could just be that the client doesn't want to use a session variable. The
funny thing is, the web is stateless anyways so maybe the client is getting
confused or means something slightly different. You could use the Membership
provider built right into ASP.Net with FormsAuthentication to take care of
the maintaining logged in user state against a db. It does the heavy work
and enables you to get the username as well as the users'd id through the
provideruserkey property.

I typically avoid a lot of state across pages. You can use viewstate within
a page if you need to to maintain the state within a page if absolutely
necessary. Perhaps the client is concerned about performance hits for using
sessionstate variables or possible issues with using sessionstate in a
webfarm or webgarden.