It is easier to work with if everyone who comes to the script gets it but it is a design thing. It can also be designed the other way a valid login would receive a session that is logged in. Update: Check out Joosts reply.