I don't think it's just the redirect ... it seems that what he wants is something that will authorize the client in a non-standard manner. Personally, I'd think you need a pretty fancy solution for that (e.g. a mod_perl enabled server with a custom authentication handler; you'd set a cookie at some point, and the handler would read the cookie and if not present, restrict access).

But there are many bright people here, I suppose they can come up with something less drastic.

Philosophy can be made out of anything. Or less -- Jerry A. Fodor