You're looking to build a user session that is constructed upon logon and invalidated after a timeout or when the user presses 'logout'. Mind you that browser caching often can get in the way here so you need to be carefull.
Generally there are three ways of building the notion of state (or session) for a webuser :
Carry all your variables and userinfo around in hidden variables (NOT recommended)
Cookies (NOT recommended because will fail if the user has cookies switched off)
URL rewriting : Assign a unique sessionID to each logged on user and append this ID to each URL
A supersearch on keyword 'session' reveals a lot of stuff that should send you on your way.