"Cloaking" in this situation would be fine. When the user agent contains
bot|crawl|slurp|spider you should not use session id parameters or check for cookies. You are delivering the same content to users and bots. Google won't have a problem with this particular cloak.
I use a similar technique for deciding whether or not to use Data URI for the images on my site. I treat all bots the same as IE 7 and earlier which cannot handle Data URIs. Technically it is cloaking, but all bots get the same data and would render the same pixels on the screen as users. They just get that data through different technical means.
onclick="if(!document.cookie.indexOf('session')this.href+='?session=abcdef1234';" Googlebot doesn't execute the onclick when following links, so it would still be able to crawl your site without parameters.
When you are using session parameters, you should log into Google Search Console and tell Google to ignore them. Open the URL Parameters Tool or view the crawl parameters documenation. You will want to add your session parameter and set it to "Doesn't effect page content (ex. tracks usage)".