It's going to be a compromise between customer experience and security. You could use SSL, sessions, whatever, but the fact remains is that HTTP is never secure (unless you conduct the entire shopping 'session' in SSL, but that will be incredibly slow and server intensive).
The PHPBuilder.com article that described their user database was very interesting, and a good compromise. I'd give that a go if I were you.
you can just mail me the cheque. 😉
