Here is one node and another that hits closer to home. Other than that I imagine you can search.

As for you session question - if you are using Apache, Apache::Session IIRC will handle it all for you. If not - a simple setup would be session table in your DB with username, timestamp, and session id. Then check for that sessionid (passed either as a param or cookie) and see if it expired

grep

Just me, the boy and these two monks, no questions asked.