Per-page processing of the Tessitura Web API session, authentication, and cart

I am currently remaking the backend infrastructure of my employer's ticketing site, so I've been studying how the website may use various Tessitura Web API methods to consistently maintain a session.  Based on my (limited) experience, I have come up with some guidelines for how each page should handle the Tessitura Web API session, authentication, and cart.  I would like to post them here so that they may help others, but also especially so that others may critique my process and offer ideas for improvement.

Per-Page Processing of the Tessitura Web API Session, Authentication, and Cart

Every page on the site should handle the session as follows:

1. Check if a Tessitura session key has been acquired. I store the Tessitura session key in the browser session.
2. If no Tessitura session key has been acquired, call GetNewSessionKeyEx() and store the Tessitura session key.
3. If the Tessitura session already existed, call UpdateLastAccessTime() for record-keeping (optional), and then check if the Tessitura session has been authenticated. I store the authenticated username in the browser session and check that to determine whether the Tessitura session is authenticated.
4. If the Tessitura session is new or unauthenticated, call LoginEx2() to authenticate with your anonymous user. I then store that username in the browser session.
5. If an authenticated session already existed, check if it has seats in the cart. I use the browser session to flag that there are seats in the cart whenever I add seats.
6. If there are seats in the cart, check for an expired cart by calling GetCart() and catching the “TESSITURA_SEAT_LOCKING_EXCEPTION”.
7. If the cart has expired, transfer to a new Tessitura session by first getting a new session key from GetNewSessionKeyEx(), using it in TransferSession(), and then storing the new session key. I would then un-flag my seats-in-cart browser session variable.

If the above procedures are implemented using browser sessions, then each browser session will potentially have the following variables:

• the key of the current Tessitura session
• the username authenticated under the current Tessitura session
• a flag indicating whether seats have been added to the cart

[edited by: Bryan Drenner at 6:36 PM (GMT -6) on 4 Jul 2011]