could always setup a databse for user accounts and have a field for user and admininstrator...
then whent hey login it checks the database and then sets a cookie and encrypts the cookie with a word like administrator or user then when they want to do somthing just check there cookie and see if there admins or not..
id encrypt it so users dont know what the heck the data is.
id use md5();