# Make sure user is logged in
hook 'before' => sub {
    if (! session('user') && request->path_info !~ m{^/login}) {
        var requested_path => request->path_info;
        request->path_info('/login');
    }
};

get '/login' => sub {
    session->destroy;
    # Display a login page; the original URL they requested is available as
    # vars->{requested_path}, so could be put in a hidden field in the form
    template 'login', { path => vars->{requested_path} };
};

get '/logout' => sub {
    session->destroy;
    redirect '/';
};

post '/login' => sub {
    my $user_params = {
        username => param( 'username' ),
        password => param( 'password' ),
    };

    my $error = form_validator_error( 'login', $user_params );

    if( $error ){
        send_error( $error );
    }
    my $user = $app_store->is_valid_user( $user_params );
    if( not $user ){
        send_error( "Login failed" );
    }

    session user => $user;
    redirect params->{path} || '/';
};