Application state or context

I kno, WordPress is stateless but it really isn’t since it does save your login state.

Any way. My client is having me build a plugin for their application. It has seven ‘public’ pages/shortcodes. They want me to create a separate user table (done) and management pages in the dashboard (done) anduser validation(done). The issue is that I need to somehow keep the users login context. I tried using Session variables byt putting a session_start in the plugin constructor. The user would validate but when they migrated to the next page, they were logged out again. I tried cookies (as WordPress does) but I can’t set them in my plugin, headers already sent. I thought about using the database but I need some type of way to correlate the session to the database record.

Any Ideas?

Using WordPress users and login, though easy, is not acceptable to the client.