Regardless of the “philosophy of the web” most webapps still use session state. This goes hand in hand with the aggressive use of “sensible defaults” in Rails. Since most webapps use a session it is the default, if you at a later stage find you don’t need the session you can always turn it off by explicitly overriding the default (on a controller local or application global basis).