Hold the presses!!!
Ok, that went faster than I thought it would....
I've completed the sessions based login system. When you first login, it will notice you don't a sessions cookie, so it will send you to a login form which is an actual webpage (hard coded right now)... no more http auth is required. Your session will be stored for one hour after your last access, at which time you will be prompted with the login screen again. To logout within that hour, you click the logout button, or close all browsers.
As for http auth, it will still work for the api people. Rules for which one is used is as follows:
If the sessions cookie is sent, a session is required.
If the http authentication is sent, http auth is used
If neither is sent, the sessions login page will be displayed.
I'd figure I'd mention this before you guys get too carried away with your fancy login scripts
If you want to have a login form on your webpage, you just pass it to:
action=http://domain.com:2222/CMD_LOGIN
method=POST
username=username
password=password
voila!
Will be out for 1.12
John