How do you authenticate administrative logins? How do you verify someone has logged in when they try to access the admin panel? How often do you revalidate a person (i.e. once they login... do various functions check that a certain cookie was set, or whatever your login method is?).
I guess that's where you could start.
