Create a session for everyone, add a token in the session that is the flag for logged in or not (set to true or the username if the user is logged in, empty if not.) then if the user attempts to access a page that is restricted and the logged in token is not set in the session redirect to the login page. You can visualize the session as being ubiquitous and the login auth portion being a subset.