I've used Apache::AuthCookie and Apache::AuthCookieDBI to accomplish this. It simulates HTTP AUTH with cookies, which gives more flexibility at the cost of some security. So far I've found it to be an acceptable trade-off, and a very useful module.