Here's how this is supposed to work. I've recently made some fixes so
hopefully this is correct.

When you click Post or Reply, the post page comes up and includes your
username/password prompts. If you are not logged in, you can edit these
prompts. If you are logged in, they are not editable (password always
shows as asterisks and it's not actually saved anywhere. The server
never knows your password).

Staying logged in requires cookies and javascript. Else, you just need
to authenticate for each post. You can still post without javascript or
cookies.

Knowing if you are logged in (the server knowing) is based on whether
you have passed the username/password check, of course, then the server
maintains that you are logged in for a while (and sets some cookies).

This "while" is based on auto rotating keys that rotate every 4-8 hours,
so you can be considered NOT logged in after 4-8 hours. If the keys are
still ok (checked on server vs. cookies), your cookies are checked that
they match some hashes of some server side account info per user (in
addition to keys). Lastly, your ip address is checked to see if it has
changed. If your ip address changes, you must re-authenticate.

That is how it is meant to work. If it does not, please let me know what
happens and I'll continue to try to improve it.

--
Retro Guy