A client's website is currently at www.example.com, with example.com redirected there automatically. I've suggested that they reverse the redirection to drop the "www", so I can set up a subdomain that can use shared session cookies (= login to example.com stays logged in at sub.example.com). However, they're concerned that the change will impact their search engine rankings. Any advice?
First of all, as you're mentioned the reason to change that are cookies - there's no need - see "sub-domain cookies, sent in a parent domain request" on Stackoverflow:
The leading dot in the domain value .example.com means example.com and its sub-domains. Without the leading dot, the cookie is only valid for this specific domain.
Note that when setting a cookie, domain values without a leading dot will be prepended with a dot. Only when the domain parameter is not set the user agent assumes the current domain for that cookie.
SEO-wise: If you go with "www." or without is not important, as long as you 301-redirect from the one to the intended one and all webmaster tools know what your intended domain is. BUT: If you would change this in an existing project, keep in mind the already existing backlinks and if it's worth to redirect them and possibly lose some link juice.