Hmm... okay. I guess this is "the simplest thing that could possibly work". Before we start enforcing the log in requirement though the application will need some way of knowing whether or not the user is logged in. Are you planning to switch to using cookies after we start on that feature?