This DEFENITELY doesnt sound like a good solution to me....

I would seriously prefer having it check the sessionid before even asking for a username/password at all...