security web pages

Theres loads of articles on the Internet about this.

Disabling viewsource is rubbish.  Never rely on client side protection such as JavaScript as this can easily be bipassed.

As for which type of cookie to use it really doesn't matter, just down to the design of the site more than security.  I prefer not to use session cookies as it reduces the servers load.

If you are doing CC payments, SSL is the best protection from third party interception that you can get.

To protect payment pages themselves from attacks, you should read up on some articles in designing secure systems, 4guysfromrolla.com is a really good site for that stuff.