Doesn't matter, not something you have to worry about. Set a timeout of 30-60 minutes on the hash, as long as the user has an active browsing session then we'll keep it around.

As soon as they go home, go to lunch, or something that takes longer than the timeout, the hash goes away.

It's not a perfect solution, but it's easy, it's quick, and it does what you want.