I suggest that you do not even put the button on the page unless you are logged in. Anyone could very easily activate disabled buttons via javascript or a tool like Firebug.
That said, you should store your username and password either in a database or a file of some sort. I would use sessions to track the users and generate the code for the button if they are logged in.
Bookmarks