are SESSION's necessary or can Auth keep track of a user

[eluser]Colin Williams[/eluser]
Every site you've ever logged in to use sessions (which, yes, are dependent on cookies) to keep you "logged in."

Look at the Session class docs to see how it works. With native PHP sessions, you can do browser-based sessions, where the session expires when the browser is closed. Neither is going to wipe out the session when you refresh. That would make them useless. Just take the time to play with each.