You can get Apache 2 to run an extra script on every input with the SetInputFilter directive, so it runs, but you don't completely usurp control, but like merlyn said, knowing what qualifies as a 'login' and 'session' is a while 'nother thing.