At the first of every page that is to be protected, start a session. See if there is a session variable set to indicate good login, and if there is, send the file. If there isn't, set a session var to indicate teh file they wanted and use a redirect header and send them to a login page.
Start the session on the login page, start by processing the login information, if it is logged in already (other browser window open from a previous update dl moments ago) and a desired file var is set, redirect 'em to the dl.php script with the file as the arg again. If it isnt logged in yet, and you have auth tokens, process them. If they are right, set the login ok variable and redirect to the dl page. if they arent correct, or arent there at all, show the login form.
This way you can either login on a gateway page, or if you bookmark a page "inside" like a forums posting, you go back, get bounced to login, complete login and get desired page.
