Why not just use r.log_id to get a unique number? or something like:
local session_id = r:getcookie("lua_sessionid")
if not session_id then
session_id = r:sha1(r.log_id .. r.clock())
r:setcookie{
key = "lua_sessionid",
value = session_id
}
end
Alternately, see http://modlua.org/recipes/cookies for how to work with cookies and unique IDs.