One login with a form, then a cookie that carries the session, and the record on the server that gives it meaning