Best case: A single ID that relates to all the other information you need, which in turn is stored in a database.
There are times when it makes sense to put some other information in there, but they are rare. You always need to ask yourself why, at least five times.
SSL will protect your users from session hijacking but, even then, never store unencrypted sensitive information in a cookie. It is, essentially, stored in plain text on the harddrive.
Finally, and most importantly, protect your user against XSS and CSRF attacks.
Either download scripts and serve them from your own server or use very well-trusted CDNs such as Google or Yahoo.
CSRF protection is usually done by having a random value in a hidden field in a form. The value is kept in the session so that when the form is resubmitted, you can verify it came from the same computer.
Most web frameworks now have very simple techniques for including that token.