You'd need to add something to the login form - an extra paramater. Then have something check the value of this(0 or 1) and if its 1(assuming 1 means hide from who's online) then set their "Display in who's online" variable in their info on the DB to 0(or whatever it would be).