if the database can be avoided in favor of an .xml file, would the active sessions still work for that? And lastly, do I have to be concerned about cookies?
Use a session variable to track whether or not you have counted the "hit". What you're really wanting to track here is Visits as opposed to "hits" or "pageloads".
In IIS, sessions last for the duration of the clients visit. There are a few gotchas. If the client does not support cookies, every pageload will end up being a different session. You can use a combination of IP and UserAgent to detect when this happens, but that means you'll need to store that in your database and somehow check against it when you're running code to count the "hit".
You don't really need to use cookies to make this work, unless you want to be able to match client sessions to see if the visitor is new or was previously on your site at some point. When I built this I opted to store a unique "cookieid" on the client so that I would be able to detect repeat visitors.