Yea the client/server model really is the best way to go.

Just a few keypoints, be sure to validate that the request are being generated from the logon script, this is easy to do using see this thread "finding a programs parrent process"

If i can help in any way, let me know!

Bryce