Login is pretty simple. I assume you have some sort of user database. All you do is store a hashed version of that user's password in your database as a field. Then, you login consists of a username and password. Whatever password the user supplies, you perform the hashing algorithm and check to see if the two hashes match. If they do, then the user has successfully authenticated themself.
However, since http is stateless, you need to provide some way of tracking the state of the application. This is usually accomplished with 'sessions' which store a cookie in the browser to be accessed later by the application. My preferred method is to generate a unique identifier and tie it to the user account in the database. Upon each successful use of the identifier, it is refreshed and the new one replaces the old. This adds a level of security in that a compromised id grants the attacker a very short window of vulnerability.
As far as your CRON jobs are concerned. You likely do not need them simply to refresh turns. Simply insert a timestamp into the database and select them back out whenever it is possible for turns to be gained.
