most secure method of password protect

With php you can combine SSL and session management to:

• only send the password once per session
  
• store the password in encrypted (md5,sha1,etc) form
  
• time out the session on inactivity so the user has to be revalidated
  
• if you know your users have static IP addresses you can check each page request to make sure that it doesn't suddenly inexplicably change
  
• log page modifications' time, ip, username, etc.
  
• force periodic password changes
  
• evaluate password strength and/or enforce strong password rules
  

Using php or some other scripting language opens up the possiblities tremendously, and you can tighten up security by a significant degree.

with regards to session management where is a good place to read up on it, or what should i be searching for?

Then there's copious real-world examples in the php scripting forum & its library.

Also absorb all you can on security: good practices for validating user input, preventing cross-site and sql injection attacks. I learned a lot from this:
[phpsec.org ]
Some of it's a bit hard to follow - your eyes start to glaze over - but if you go back and read it again after chewing on it awhile, it makes more and more sense. Since your first objective with sessions is security, you might actually want to first skim through that article quickly, ignore what you don't understand right off the bat, then go read the session stuff at php.net.