You don't need to authenticate users, let your webserver do it for you. Most web servers will pass the user name as an environment variable (plus there username is sent every time they request your page, no cookies needed). Then you just have a file with the user name and their privleges.