Well it's really quite simple:
When a user logs on sucesfully, that is, you have verified his identity,
set a cookie on his browser (read the cookies section in the PPH manual for instructions).
For low security you can just make is a cookie like "loggedon" and give it a value like "yes" or something like that.
For high security, use random numbers, md5 and store copies of those numbers on your server so you can verify that the cookie exists and contains the correct
value.
Now on every page the user visits, first check if the cookie is set with the correct value. If so, display the page. if not, give an error.
Then when a user logs out you either erase the cookie or set it to a value so you know he logged out, like "logged" = "no".
