The way I implemented this in Mason is to have a perl block at the top of my autohandler that redirects the user to the login page if he is not valid. The login page has code that redirects the user to the main page if he is already logged in.
I use session variables to store login status so I don't need to pass any information around.
Because it is in the autohandler, I don't have to code the security for individual pages, plus if someone bookmarks a page deep in the system, he can't use it to get around security.