Anonymous Yet Protected Access to CCK Node Add/Edit

I appreciate any and all responses to the following—thank you.

I have a client that would like a node submission form available to anonymous users with the correct secret registration code. (As other functionality stands, the CCK node is attached to a product via Ubercart Node Checkout, the anonymous users creates the node, pays for it via Ubercart, and has a user created through the checkout process.)

My initial solution was a blank CCK textfield with only one accepted value. The client was not content with this user experience, wanting instead the user to submit a small form on a different page before he or she could even see the node creation form.

So far, I have created a custom module that generates a block with a single password field and a submit (which I placed at the bottom of a page detailing the process). If the proper registration code is entered, the user is redirected with drupal_goto to the node creation form. If the value is incorrect, the user stays on that page. This works.

I attempted to 'protect' the node creation form with a session variable check in hook_form_alter. The hook_form_alter is getting called for the node creation form, recognizing that the session variable is not set to 'authorized' but then its drupal_goto call back to the code submission page never executes.

Any ideas why this drupal_goto is never being called? Or, alternately, is there a far superior means of accomplishing my target user experience? I feel the way I'm doing things is fairly hackish. I've not dealt really at all with programmatic permissions and access, well, at least not them being set on the fly.

Thank you!