* Generate a session token upon login.
* Store that session token in the database.
* Check for valid session tokens when authenticating.

Pretty much what you have. Just consider if you want to have more than one valid session at once and how you'll go about expiring sessions.