Sessions for Anonymous Users

[Sean Brant]

So I have a invite system for one of my projects and right now when a
user clicks the link /invitations/<key>/ I get the invitation object
and store it in request.session['invitation']. Then I redirect to /
accounts/new/ if request.session['invitation'] is None then I produce
and error if not I present a registration form. Once the form is saved
successfully I remove request.session['invitation'].

Any advice on this? Something feels wrong about storing the invitation
in the session. Is this going to be a safe maintainable option? Should
I be storing something in a cookie instead, or just put the
registration form on a page that contains the key in the url?

Thanks for any design decisions you might offer up.