I've been searching this and other sites... Here are aspects of the project:
1. Multiple directories for files for multiple users.
2. User logs in, can change password, add secret question / answer. (can do that part)
3. User then gets list of files in their directory (same as username) and can click on and view files. (rtf, pdf, zip files)
4. No cookies, must be session based since some on shared computers. (no problem with that)
Problems with approaches:
1. Tried .htaccess and .htpasswd and too complicated and cumbersome to set up and change.
2. Tried to find a way to get browser to grab file from dir above public_html but nothing worked (it would just show the code of the .rtf file instead of calling ms word)
I'm sure it's easier than it seems at this point!