I think all serious website will persist shoppingcart info into database, petstore store uncheck item inside httpSession, that's not safe, plus it make clustering bit difficult to be realized.
People do usually use httpSession id ( thru coookie or URL rewrite) to identify unauthenticated client, after you login, they will switch to your user id.
Cheers
-Wanchun