It seems to be using some homegrown sessions and looking at some of the HTML source there are a few hidden fields that are passed back and forth and those probably control the sessions. Look at the source again (and that one javascript method is contained in that page) and see what other fields you might be able to pass along. The "mechanics" of this seem to be correct, it seems, now, as though you simply need to find the right information to post. If need be get a packet sniffer and make the connection with the browser and then examine the network traffic that resulted and see what is really going on.

