That is true, but obviously you should think of the user experience first and foremost. Usually I would not suggest one method, but a combination (cookies, http_accept_language, etc..) so that if one fails you still have other ways to language the user wants.
Using cookies and session is not a problem most of the time if it is backed up with other systems in place. The method provided my Hujer is a perfect example as
the /lang/module/controller/action can be implemented with a custom router to detect if there was a lang prefix else display the default language.
With several systems in place the user will enjoy the automatic detect of their own language and you get the benefit of seo as most spiders dont submit their language anyways.
Detection:
- GET/POST
- Cookie
- Session (usually never needed)
- HTTP_ACCEPT_LANGUAGE
- Default language