http://kkaefer.com/blog/securing-drupal-s-user-login