Lyle is correct. If you are going to store any sort of persistent data for a user, a session is the most secure way of doing it. The basis of the problem is that http was designed to be stateless. query strings, then cookies, and finally sessions were all created to overcome this "shortcoming" in http.

In order to do e-commerce over http you just about have to have some sort of system to keep the state of the customers. In the past, people have been reluctant to depend on sessions or cookies because they were insecure and or many customers didn't support cookies. At this point sessions are (when correctly implemented) secure, and only a very, very small percentage of web users don't support cookies.

As a result, Ubercart requires sessions. It would be very difficult to make Ubercart work without sessions or cookies, and it would only be used in very rare circumstances, so I don't think it is worth it.

Hopefully you can convince your people that they should use sessions.
Peace,
Andy