beveiligings class veilig genoeg?

beste PHP hulpers,

ik heb een beveiligings class gebouwd die ik universeel wil gaan gebruiken binnen mijn projecten. mijn vraag aan jullie kunnen jullie hem is bekijken en mij wijzen op fouten/lekken in de beveiliging en wellicht tips geven.

aub geen commentaar geven op het mogelijk onjuist gebruik van OOP maar dit is mijn manier van OOP gebruiken en ik vind hem zo fijn.

het script
class.auth.php
<?php
//class.auth.php
//last modified 19/07/2009
//version 1.0

class authorization {

public $minlvl = null;
public $error = null;
private $db = null;

function __construct($minlvl = '0')
{
$this->minlvl = $minlvl;
$this->db = new database();
$this->login_check();
}

//login_check, checks if user has acces to the current page
protected function login_check()
{
if (($_SERVER['REQUEST_URI'] == "/login/") or ($this->minlvl == "0")){
return false;
}

if ($_SESSION['adminlvl'] < $this->minlvl){
$this->logout();
}

if($_SESSION['fingerprint'] == hash("sha512",$_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'].$_SERVER['HTTP_ACCEPT_LANGUAGE'].$_SERVER['HTTP_ACCEPT_ENCODING'].$_SERVER['DOCUMENT_ROOT']."authorized")){
return true;
} else {
$this->logout();
}
}

//login, verify the user's credentials and give him/her acces
protected function login($username = '',$password = '',$redirect = '')
{

if((!empty($username)) && (!empty($password)) && ($_SERVER['HTTP_HOST'] == HTTP_HOST) && ($_SERVER['SCRIPT_NAME'] == '/login.php'))
{
$password = hash("sha512",SALTKEY.$password);
$query = $this->db->query("SELECT user_id,adminlvl,ipadres FROM users WHERE username = '".$username."' AND password = '".$password."'");

if($this->db->num_rows($query) != 1)
{
$this->error = "Verkeerde username of password";
return false;
}
else
{
$rec = $this->db->fetch_assoc($query);

$_SESSION['user_id'] = $rec['userid'];
$_SESSION['adminlvl'] = $rec['adminlvl'];
$_SESSION['username'] = $username;
$_SESSION['lastip'] = $rec['ipadres'];
$_SESSION['fingerprint'] = hash("sha512",$_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'].$_SERVER['HTTP_ACCEPT_LANGUAGE'].$_SERVER['HTTP_ACCEPT_ENCODING'].$_SERVER['DOCUMENT_ROOT']."authorized");

if(!empty($redirect))
{
header("Location: ".$redirect);
}
else
{
if(SSL == "1")
{
header("Location: https://".HTTP_HOST."/";);
}
else
{
header("Location: http://".HTTP_HOST."/";);
}
}

return true;
}
}
else
{
$this->error = "Aanmelden mislukt";
return false;
}
}

//logout, safely destroy the acces token and redirect the user to the login form
public function logout()
{
unset($_SESSION);
session_destroy();
header('Location:/login/');
exit();
}
}

$auth = new authorization();
?>