It's not difficult at all. You can check to see if a session
var exists like so:
cfif structKeyExists(session, "fname")
What I would consider is using onRequestStart to check for
one session var that you know exists, like fname, when the user is
logged in, and if it doesn't exist, you push them to the login
page.