It seems that I had to ask the question in detail before finding the steps to an answer.
The scheme that I have figured out so far is this:
1) Use Manage Security to set up accounts that do the various functions
2) Disable [Guest]
3) Then create the site using PHP Site Assistant. When it sees that [Guest] is disabled it will automatically prompt for your admin password and create pages that look for authentication. If [Guest] is enabled it doesn't give a peep about this capability.
My problem was that I had created my site pages when the DB had [Guest] enabled, thus the site assistant hadn't put in any code for authentication. So I had to start over with the site assistant in order to get the authentication stuff.
5) please explain to me what the heck I'm doing working on this stuff before I even know squat about php.
By the way, does anyone know how to create new site templates for Site Assistant?