authenticating w/ session variables

i have some pages in a web site that are behind a password protected page. i need to keep them from being bookmarked and other wise linked to directly without logging in. the log in works fine. i've seen some other code that tries to do this, but it is (for my use) rather complicated, and i haven't been able to make anything work. i wrote a quick "authenticate.asp" file

<%
dim UserID

UserID=Session("Admin")

If NOT (UserID = "gohamel") AND NOT (UserID= "djanke") AND NOT (UserID= "jhroy") Then
Response.Write "You are not authorized to view this page. Please log in"
Response.Redirect "Login.asp"
End IF
%>

which i thought would just check the session variable to see if it was one of the 3 allowed admin. the Session("Admin") part is set in the program that logs in, and the line

<%
response.write "your session name is " & Session("Admin")
%>

returns that Session("Admin") is indeed one of the right three, it just doesn't work in my little authenticate part. i must have a concept problem or something. anyone able to help? i just need to kick the user to the login page unless they have logged in as one of the 3 admins, no other checking needed. thanks in advance

oh, in case it helps: i don't get an error message or anything from the pages i have included the check on, it just redirects everyone to the login page all the time, even the admins who it should allow

boy do i feel foolish, lol. honest, i have tried this thing called "programming" before, not that you can always tell...

changed logic to echolia's suggestion, but it still doesn't work, it just redirects me

using this modified code:


i recieve this output in the browser:

You are not authorized to view this page. Please log inFalse

at the same time the original page shows

your session name is djanke

which is one of the authorized names, so i don't get it

if it worked for you, i'll assume the authentication itself is right, and see about how the other file sets the session. i'll post another question if i run into trouble again. thanks for your help

Just in case anyone else has a problem similar to this or something, I changed the authentication code to check for an empty session

This way, they can't just go to the marked pages, (bc they would have an empty session), and they can't log it with another name (that is caught by the login page). I also disabled page cacheing, and it is working perfectly.