Logins should use separate authentication becase including it in any CGI program will typically overcomplicate things. Not to mention the significant potential to leave holes in your authentication methods. Simply put, authentication is best left OUT of your program.

Authentication is best done by your web server, which will leave no doubts as far as who is allowed to see what by the time they get to your script. Storing sessions is a different topic, although related.