Code:
header.location( "http://www.thissite.com/login.php?user=" . $_POST[username] . "&pass=" . $_POST[password] . "&ref=0000" )
That isn't good coding to have the password displaying in the URL.
All you need to do is. Display the login box on the primary site then set the form action to the secondary site, i.e
Code:
<form action="http://www.secondary-site.com/login-script.php">
So when the click the submit button it will login at the secondary site then just use some simple javascript to to them back to the primary site. If your more advanced, i think you can use AJAX to login at the secondary site with out refreshing the page!
Bookmarks