SESSION:Find current active users in my app???

[eluser]mindprojects[/eluser]
All right...i like this way even if i think it is quite onerous if your system handle many users.
I got it...
1)The users are not registered because they log in with code and pin if the card has not been used.
2)I create into my table "order"(a sot of users table) a new record where i store the token,and i take the order_id(incremental key) and i store into the session the order_id and the token
3)At he same time i store into a table "order_codes" the order_id and the code used.
4)if a user came with the same code,i check the orde_codes to see if the code has been used,if it is, i get the order_id
and i unset the token into the table "order".
5)The previous user will be logged out.

I think its right
Now the questions are ...

1)TOKEN :how to generate a unique token?DO you get the session_id as unique token or do you have an incremental table for tokens?

2)LOGIN SYSTEM o you store something else into your session as "logged_in" = 1 or the only token is enough?