This may not offer much advice for your particular application, but may at least show you how NOT to handle authentication. Its the best resource on the subject I've seen thus far [PDF]:

http://pdos.csail.mit.edu/papers/webauth:sec10.pdf