Authentication should be on the checkout page and would have the return url of the pp_confirm page. Maybe the problem is the action for the express checkout page should submit to itself and not to the pp_confirm page directly.
Your friends over here at WebAssist! These Dreamweaver extensions will assist you in building unlimited, custom websites.
These out-of-the-box solutions provide you proven, tested applications that can be up and running now. Build a store, a gallery, or a web-based email solution.