First, I'd have to recommend md5 and not SHA-1 (sorry stew), as it has been shown that SHA-1 can be hacked, and it was just announced that a faster hack of SHA-1 has been created (http://it.slashdot.org/article.pl?sid=05/08/18/2247245&tid=93&tid=172).
The users.txt file should have the minimum permissions needed to still be workable. Assuming you're using a *nix system, I would recommend making sure it has 600 permissions, realizing that the PHP user is the owner of the file.
In login.php, the exit; command near the end (after setting the SESSION variables and cookies) is superfluous; since all the code afterwards is within the else statement, it won't get executed no matter what, and the interpreter is smart enough not to waste time on that code.
I would suggest using a require_once instead of an include_once on all your protected pages, as the include statement will only warn if it can't find the file, and require will return a fatal error. Because if this, if your protect.php file were moved or deleted, and a file couldn't find it, the include_once would display the protected page, whereas the require_once would not. This is a fairly big security risk.
Your function output_error is used in multiple places. If it is exactly the same code in all those places, then I would recommend creating another page (functions.php) and putting that function in that file, and then including that file in all the other pages. Or you can put it in a page that's included in every page already. This way, if you need to update the function for some reason, you only need to do it in one place. Plus, you save disk space only having the code in one place.
In pass.php, I'm not exactly sure what the $__pass variables are (I'll assume you do, though :-P). I'm assuming that $nowpass is the entered current password, to make sure that they know their current password. Assuming this, at one point you check to see if $POST['nowpass'] == $_POST['newpass']. All this does is see if they typed the same password in three times (in nowpass, newpass, and newpass2), not if their current password (in users.txt) is the same as the password that they're trying to change it to. I'm not sure if this is what you want to do, but it seems to me that you'd want to check it against the users.txt password, not the entered password.
Unless you have a good reason not to do this, I would recommend using relative paths, opposed to absolute paths, as it makes your code much more portable. Of course, you probably shouldn't do this when opening the users.txt file, but for other files, like header.php and footer.php, this would mean that if ever have to move the code to another machine, it will be much eacher.
