Which is the better option - storing data in cookies or using SQLServer to store session state rather than InProc? My goal is a 240 min time out.