If website A and B are linked internally, you could just transport the session information, so the session key can be used to automatically login to website B - doing this without website A and B communicating internally somehow would very very difficult to secure.
Basically you need a method of A telling B which client session codes are valid, without relying on the client transmitting this information.
Of course it is possible to do it this way using PKI, but I imagine that's a little overcomplicated for you situation. In any case, this solution would basically be implemented as follows:
- Client connects an logs into website A
- Website A creates session cookie and signs it with website B's public key
- Website A redirects client to website B along with signed cookie
- Client goes to website B, presents signed session cookie
- Website B reads session cookie, verifies it with website B private key
- Client is now logged into website B
Bear in mind this whole process could still suffer from a number of attacks if any of these connections are not secured via SSL/TLS.