Hide All Content From Unauthenticated Users but Show Login Options?

I'm new at drupal but have been bravely muddling through for about a week now (working nearly around the clock). I have extensive html experience and a goodly amount of css experience, but am a novice when it comes to php and mysql. (I did try mambo and one other site before deciding drupal was the easist to use.) I have searched this site and forum extensively, I have tried various settings and modules, and I have yet to solve this issue to my satisfaction. Anyone useful feedback would be appreciated (and, since I've seen many questions about this issue on the boards, I promise to document my final solution).

Here's the scoop:

I am building a members-only site. I do not want it indexed in the search engines. I want to moderate all new memberships (meaning, I want to be able to approve members before they join). I will be inviting new members to the site and sending them a link to a sign-up page. However, I want them to be able to create their own user name and password (I don't want to have to do this manually for them).

My drupal site has been created in a subdirectory of my main domain's site, so let's refer to my drupal directory as "subdirectory". When potential new members get a link to come sign up, it should have a link to mysite.com/subdirectory (right?). When they get to that page, there should be the "register" and "sign in" and "lost password" options, and *nothing else*. When I tried to apply access blocks, there were still some features that always showed up on that page, such as the logo link in the header, the primary links, and the search bar. Even when signed out, I could access all the site content via any of those links, making the site not secure in the least. (And, yes, I have it set so that: "Visitors can create accounts but administrator approval is required.")

Next thing I tried: I added the "front page" module and created a new front page for unauthenticated users. I had to really manipulate the html code for that front page, in order to make sure there were no breadcrumb links, no header links, *nothing* but the login options. Unfortunately, that still did not work. The code I cut and paste from my original login page included tabs for "register" and "lost password". When clicked, those took me right on in to user pages that had the header links and other items that could be easily used *to access the entire site*. So, still NOT secure. I then removed from that code the tabs for the sign up and lost password options and realized that what looked like a title for the login area was also *a link* that (again) took the unauthenticated user right on into a user page that had content they shouldn't have been able to see. So I got rid of that link, too. Then, just for giggles, I logged out and then tried putting in a bogus user name and password--guess what? It took me to an error page that had, you guessed it, links to stuff that unauthenticated users shouldn't have access to. :(

In addition, I'm having some difficulty formatting the front page module and there isn't enough documentation on it. (I figured out how to create the front page for unauthenticated users, for instance, but now I've lost the content that was on my old page (the one for the authenticated users)--which I think was just "node"--and it was looking gorgeous. Grf. That means I now have to create a brand new home page for authenticated users, as well, I guess...?) In addition, that left no place for new *invited members* to create a user name or request a lost password.

Next, I tried adding the secure site module. I'm not really liking that form of user validation. For one thing, doing that and hiding the user login box means that now I don't know where to put a box for the initial sign-up process or where members should go if they need a new password. Also, when I log out with this module enabled, the http login box immediately pops up, and that's annoying. Plus, it doesn't really even work. Even with *all of the above in place*, I can still log out and access my site by going to: mydomain.com/subdirectory/user. So what's the point?

Those who might try to hack my site aren't nearly as inexperienced as the people that I actually *want* as members. So now I've just made membership super difficult for the people I want to join, and yet anyone with enough skill to use google properly can easily find a way in, authenticated or not. I have to plan for the lowest common denominator--I'm the one who is going to be providing tech support for site access and I'm dealing with a relatively low-tech bunch.

So that's where I'm at. I'm sure there's something I'm missing. So far, I've spent a significant amount of time customizing my site's css and theme layout, I've installed some modules, created a custom menu, used the url alias feature, but I haven't boned up on "taxonomy" yet, nor have I created any static pages.

Has anyone out there found an easy solution for this issue? Programmers, please be gentle (assume that I know *nothing* and can't yet speak the vernacular). I need step-by-step suggestions on how to keep unauthenticated users from accessing *any* of my site content, except for a page that allows new members to sign up, and existing members to sign in and/or to request a new password. I'm pretty confident about jumping in and altering things in my theme's css and xtmpl files. Throw anything else at me and you'll need to be very specific. ;-)

Thanks.