Secure web site structure:

All files should begin as follows:
<?php
require_once ("/wwws/functions.php");	// site-wide functions
$user=sessbegin();                      // are they logged in (session started)?
require_once ("auth.php");		// note this is in local directory
auth($user);                            // are they allowed to see this page?
require_once ("/wwws/default.php");	// site-wide navigation bar defs.
$mainitem = "Forms";			// indicate which item on nav. bar to hightlight
phasbegin();                            // show site-wide banner and navigation

-------------
functions.php
-------------
- contains any general functions required for the secure site
- function sessbegin()
	- all scripts that produce web pages should call this function
	- checks to see if there is a valid session for this cookie
	- if there is not a valid session, the user is redirected to login.php

---------
login.php
---------
- this is the login form and any requests that have not been authenticated
  (ie. there is not a valid session established or one has timed-out) will 
  be redirected to this page
- this script also handles the "Logout" button, ie. the current session is
  destroyed and the login form is displayed

---------
index.php
---------
- home page for the site

-----------
default.php
-----------
- all scripts that produce web pages should include this file (site-wide)
- contains the default values for the global variables that control banners, menus, etc.

---------
/auth.php  - in root directory
---------
- called by hitting "Login" on the login form
- first validates the username/password input, then authenticates by connecting
  to the localhost via imap
- if authentication succeeds, user is redirected to index.php
- if authentication fails, user is redirected to login.php

----------
./auth.php (in each sub-directory)
----------
- contains a function "auth($user)"
  	- determines whether this user is allowed to see a page in this directory  
	- calls "allow" function (in functions.php) with right parameters
	- if result is false, redirects to rejection page