> If you're using a system that has them built in, lovely, but if you're not, it's a lot of extra work.

They're built in with PHP and most Node.js frameworks I've ever worked with.

I'm not sure about Python, RoR, etc. web frameworks but the engineering overhead for adopting server-side sessions should approximate 0, since they're usually the default.