I would treat users that have not yet registered as closely as possible to normal users. So create a user object in the database for them and keep track of the

I would treat users that have not yet registered as closely as possible to normal users. So create a user object in the database for them and keep track of the last access date. You can either mark the account as temporary, or just store an empty password and rely on that to identify accounts that are not fully registered. You can purge inactive accounts after a certain number of days. If it's only keyed by session ID then there's no point to keep this data around past the session expiration date. Then in a few places in your app you can check if you have the necessary information on file for the current user acocunt, and prompt the user to enter it if not (things like email address, a picture, real name, whatever it is you need). When they finally select a password they become a normal user of the site.