How about this implementation? 1) No log required to do the main search (as before) 2) Instant and Robot Dupe show don't show the contract, result, or percentage. 3) Instead, it has a link to log in. 4) When logged in, it then shows everything filled in if it's your tournament, otherwise a note. This might make things a bit better, though doesn't address all the concerns above. General principle here is to only protect what needs to be protected. Right now, it's authorizing too early and authenticating on a bit more than needed. Also, another improvement would be to use longer cookies for authorization. For something as low risk as this, there's no reason to require logging back in frequently. Having it last a month would be quite sufficient and much more usable.