|No such thing as a small change|
If you can't use .htaccess files, and you don't want to use CGI, then I see it that you have only two options remaining:
The problem with #1 is that you're going to be at the mercy of your server. Most servers only offer HTTP authentication which looks and functions much like .htaccess files do. However, some really cool web servers allow you to massively customize the authentication process in order to make it "look nicer" for your client.
Option #2 is better in some ways. It lets you keep every page in HTML with no CGI and no server issues. It's somewhat annoying because it forces users to allow cookies, but IMHO, everyone should set cookies to auto-go.