There is no need to edit awstats.pl in order to use the session ID instead of the client IP. I would use the cs(Cookie) field as %host in the AWStats LogFormat definition. If the complete cookie field is not convenient, you can filter the log file with a program that will extract the session ID before you pass it to awstats.pl .
Regarding your second question, I do not know of any easy way to identify the users who visit the site during more than one hour. This would demand serious changes in the AWStats source code.