You are using old super global variables, you should use the new superglobal variables which are
$_POST instead of $HTTP_POST_VARS
$_GET instead of $HTTP_GET_VARS
$_SESSION instead of $HTTP_SESSION_VARS
$_COOKIE instead of $HTTP_COOKIE_VARS
Also this code here:
// if they've tried and failed to log in
echo 'Could not log you in';
// they have not tried to log in yet or have logged out
echo 'You are not logged in.<br />';
Is a little strange. You are checking to see if $user_name exists, and if it does you say you cannot be logged in.
Otherwise if the user fills in the form correctly and hits submits it always goona say 'Could not log you in
'. With the latter code it now checks whether the $user_name var doesnt exist.