A more secure way? Use https along with this. There are two vulnerabilities here:
- When the user logs in, the password that is sent over can be easily read by anyone snooping on your connection. This can't happen on an https connection.
- If a user is already logged in, someone snooping on your connection can just copy over the session cookies. In HTTPS, cookies are transmitted securely, so there isn't much of an issue.
You may also want to log the user IP address and not let them switch, though this may get annoying (for a user like me who is behind a university proxy with rotating external IPs, I'll never be able to log in).
A final observation: Don't use GET for the log out bit.. Try not to use GET for anything which triggers a change -- it's fine for navigation, but not for anything which will lead to something changing on the server (a logout, or anything that writes to a database). See the prescribed usage of GET and POST for more details.
If you implement the above, then also make sure that the referrer of a POST request is your site and not some other site. (This, along with the above, will help prevent CSRF attacks).
X-Frame-Options: deny header.