I was never able to get this with php, but I do know that when I did it with aspx/c# My login control created a session handler, which basically was whether or not they were logged in. If they were not logged in, they would be redirected to the login page when trying to go to specific content.
So a cookie must be assigned with the session of the authenticated user... but for me I was never able to authenticate the user against the hashes, just didn't quite work out for me.. plus I was on a major timeline for the project due date, so went with .aspx instead... so you have to find out more about handling the sessions w/ cookies in php, but for me it was different unless your doing the same thing (authenticating users after they have created their accounts to access specific information such as classes and registration information in my case).
Hope this helps out.