Extremely basic authentication class
jsanc623 had some good points, but I think he missed a lot too.  In particular, I think you have a fairly major design problem.  Without seeing all of the related classes, my comments are a bit limited, but there's a few things below.



There's a few different 'concerns' your code is handling here:


Authenticating (is the username/password pair x, y valid?)
Persisting an identity (remembering that the user is logged in under username x)
Checking permissions


These concerns should be separated.

The logic of "is [x, y] a valid authentication pair?" and the logic of "can this person do z?" have no need to be coupled.

Additionally, there's no reason to hard code all of the session stuff.  (The class should definitely not be responsible for starting the session.)



Based on the API seen, I have a suspicion that your controller and model classes have convoluted functionality and APIs.

You might want to consider looking into how a few different frameworks have handled authentication.  Zend Framework is the only one I have experience with the authentication components.  It has a few quirks, but overall, it has a good API.