The attributes setclientcookies="yes" and clientstorage="Cookie" tell ColdFusion to store cookies on the client's computer. You suggest you use sessions, so your cfapplication tag could be something like this:
<cfapplication name="xxxxxx" clientManagement="yes" sessionManagement="yes" setClientCookies="no" scriptProtect="all" sessionTimeout ="#createTimeSpan(0,0,20,0)#">
However, with no CFID or CFToken cookies on the client, ColdFusion will be unable to maintain sessions automatically. You will therefore have to do so manually. Also, client variables will be stored by default in your server's registry.