User Authentication - Placement of code?

[eluser]RyanH[/eluser]
[quote author="dawnerd" date="1200962457"]You're doing it correct, however it's not very secure. Ideally you would store the session in a database and use unique hashes to check if the user is actually who they say they are.

To log the user out, just destroy the session.

Like I said before, basing it only off session id's is just asking to be hacked.[/quote]Thanks. I am actually storing the session information in the database, this was just an example. However, what would be a more secure way to check to see if the user is who they say they are?

Where would the code go to destroy the session?

Also, is there a way to modify the CI code to allow for the storing of custom information, such as usernames or what have you? The user guide says that you can use the information but upon reading the Wiki and searching the forums it appears that you can't, at least currently, store anything beyond the standard session information in the database.