Hi,
If I had to use some kind of authentication I'd:
1) split the authentication process and the game itself
2) use google/facebook or (something else you'd like) to authenticate users
So when user enters the page you can ask him to log in using his existing account on other website. If he agrees to authorize your page and you can display the game. Then if you need to get the ID of the user or some other data connected to the account you can safely ask some php script by ajax and it doesn't matter if it's get or post. Because of the fact that php is authorized you don't need to pass any sensitive data to the script.
here you have some links
authentication using oauth with google account:
code.google.com/intl/pl-PL/apis/accounts/docs/OAuth2.html
and authentication using facebook:
developers.facebook.com/docs/guides/web
facebook makes it easier to implement it but I'd suggest to use either oauth or both
I hope you get the idea. If something is not clear I'll try to answer any questions as good as I can. :)