[rt.blitzed.org #189] staff site authentication

<URL: http://rt.blitzed.org:80/Ticket/Display.html?id=189 >

> [dg - Thu Dec 18 10:21:55 2003]:
> 
> Andy Smith via RT wrote:
> [..]
> > I guess [no choice](2) isn't so bad, but [warning](1) is a real shame.
> 
> A little bit of self advocation - maybe you'd like to use my javascript
> login stuff rather than ssl although (it needs mozilla/ie5+), so users
> on older browsers or javascript disabled are insecure.

This is now used at http://blitzed.org/login/ (on older browsers, KHTML
(Safari/Konqueror) and Opera) it falls back to sending over normal HTTP.
Using SSL would be good for these.

The staff site now also uses it, as the code I had used an sql db I
changed the staff site to use one for sessions (it would have been
easier to not have done, but it was too late when I realised how much
the staff site relied on sessions).
(Note: if you do auth from any functions on the staff site you will need
to remember to global $authenticated_user_id)

This means that the old blitzed.staff passwords aren't used (grifferz
especially: should we delete that column from the table?).