deadsea - 6:37 pm on Apr 27, 2011 (gmt 0)

You are absolutely right about cookie validation. I omitted it for brevity.

If you use multiple parameters, you have to specify a canonical order. The redirect issued for the actual url not matching the expected url would take care of that canonicalization.

If you are adding or removing parameters, you are by definition changing your urls. That can be risky and you need to think about it carefully. It can be done with proper 301s and such.

I tend not to use parameters much anyway. I prefer short friendly urls. When choosing the url for your product page you have lots of choices:
/products/detail.cgi?productid=1234
/products/1234
/products/small+blue+widget
/small+blue+widget

I'd prefer the last one, but then you have extra headaches such as supporting product name changes. Even in the last case you probably want to canonicalize
/small+blue+widget?tracking=source
At that point I actually prefer the canonical tag because cookies and 301s introduce a level of failure for good tracking. (cookies disabled, cookie size exceeded, etc)