Hi Matt,
You can pass query string parameters to the supporting pages of a feature as long as the parameters don't contain data that needs to be secured.
You should not pass parameters to other CMS pages, only to supporting pages of your feature. To learn what I mean about supporting pages you should watch the developer training videos, especially 22, 23, and 24 of the series.
I'm not wild about session variables and don't use them in mojoPortal code but you can use that approach if you want to. It depends on your scaling needs and how much server memory you have available. Session variables use server memory and most budget or shared hosting doesn't provide lots of memory but if you are on a dedicated server with more memory it may be fine for your needs.
Hope that helps,
Joe