We decided to use our own proxy to achieve authentication. Details on the first version of the proxy can be seen here
Essentially we use a standard login using Ajax against our client database over https. We return a Guid, which is stored in a table on the server, to the JavaScript and modified the proxy code given above to validate back against the database before passing the request to GeoServer. On Session Timeout, or user logout, the guid is removed from the Server table.
Any requests with an invalid guid are just dropped. I cannot give you the code because it is integral in our security system, but you should be able to get the general idea.
You can use this feature to log different events, provide a public request for x number of events and so on.
Cheers
Mark