Login system security

[Eurig Jones]

I'm trying to decide on a Login/Logout system to protect my files using 
JSF.. I've played about with extending NavigationHandler, but the 
problem is, it doesn't protect the files which aren't JSF, and you can 
still run the JSP files if you wanted to...

How have you people gone about a database driven login/logout system 
using Faces?