PHP4 && Oracle Security

Hi, I'm building a new intranet application and parts of it will be public to our customers and I'm considering the following: 1. storing login info in session variables ($usename and $password) and avoid use of persistent connections connecting every page request, all security is enforced on database. I think this could be very interesting but the connection overhead could be very high. 2. create an oracle user called SECURE with all authentication tables and packages, and create another user called NOBODY with create session privilege, execute only on the SECURE.PACKAGES and several disabled roles. put ociplogon(nobody,nobody,database) on prepend file and a custom function to disable all roles on append file. when the user send the login information an gets authenticated it enables all necessary roles using SECURE.PACKAGES and access all necessary information. what do you think about the two solutions. Thanks in Advance ! Alessandro Oliveira