I initially thought of using htaccess, but they want a login area as part of the design, rather than an alert appearing when you try to go to .com/secure

AKAIK you can't tie a <form> into htaccess (although someone feel free to correct me if I'm wrong)