Do you have any session management currently? Bottle doesn't include any out of the box, but there are middleware solutions available. For example, see this recipe.
If you're not familiar with web app session management, essentially the first time you see a client visit your site you create a unique random identifier for them and set it in a cookie in your response. You also create a record in a local file or database (on PA a database is probably a better option). Whenever they make a new request, you read the cookie and use the identifier it to look up their session information in the database. Once you've got a session you can store whatever information you need in it. Typically, frameworks and middleware platforms offer this as a nicely packaged solution which automatically sets and retrieves the cookie without you having to worry about it, and I recommend using one of those, at least at first.
There are various security issues related to session management which you may wish to look into, but I wouldn't worry about those at all until you've got a basic solution working.