It is best to separate the main controller from the others. All calls should be to the login controller.

## login_controller.rb [ruby]
  before_filter :enable_login # you can write a before_filter to load the @user object that will be needed after login
  def show_login_index
    # the rjs here is small enough that you can write it directly into the controller if you wish
    # (or wrap the contained code into an rjs template named 'show_login_index')
    # note that the purpose of this specific action is the extra effect
    render :update do |page|
      page.replace_html 'ajax_login', :partial => 'login/index'
      page.visual_effect :shake, 'login_status', :duration => 1.5
    end
  end

  def show_login
    # ajax action
    render :update do |page|
      page.replace_html 'ajax_login', :partial => 'login/login'
      page.hide 'ajax_login' # I believe you can switch the page.hide first if you wish
      page.visual_effect :blind_down, 'ajax_login', :duration => 1.5
    end
  end

  def login
    # the UserStore object is just something that I use to keep track of login attempts... it's probably not the safest as it shows the real password in the db... replace it with your login method
    if request.post?
      @user_store = UserStore.new(params[:user_store])
      if @user_store.save
        user = User.authenticate(@user_store.name, @user_store.password)
        if user
          session[:user_id] = user.id
          @user = user
          # this is just some extra code that you might want to have
          if user.last_login
            flash[:notice] = "Welcome back, #{ user.name }. You last logged in #{ user.last_login.strftime('%whatever')}."
          else
            flash[:notice] = "Welcome to <the app>, #{ user.name }."
          end
          render :action => 'show_login_index'
        else
          flash[:notice] = 'Sorry, invalid username/password combination. Please try again.'
          render :action => 'show_login_index'
        end
      end
    elsif request.xhr?
      render :action => 'show_login_index'
    end
    # if it's a GET request, it should show a fancy login page
  end

  def show_logout
    # ajax action
    render :update do |page|
      page.replace_html 'ajax_login', :partial => 'login/logout'
      page.hide 'ajax_login'
      page.visual_effect :blind_down, 'ajax_login', :duration => 1.5
    end
  end

  def logout
    if request.post?
      session[:user_id] = nil
      @user = nil
      flash[:notice] = 'You have been successfully logged out.'
      render :action => 'show_login_index'
    elsif request.xhr?
      render :partial => 'logout'
    end
  end

## _index.rhtml [ruby]
  <!-- use a before_filter on the main controller to provide an @user object, the login controller provided it already -->
<div class="flash" id="flash_inline">
  <%= flash[:notice] %>
  <% flash[:notice] = nil -%>
</div>
<div class="text" id="login_status">
  <% if @user -%>
    Logged in as <%= @user.name %>. &nbsp; | &nbsp; <%= link_to_remote 'Logout', :url => { :controller => 'login', :action => 'show_logout' } -%>
  <% else -%>
    Not logged in.
    <%= link_to_remote 'Login', :url => { :controller => 'login', :action => 'show_login' } -%>
  <% end %>
</div>

## _login.rhtml [ruby]
  <div class="flash" id="inline_flash">
    <%= flash[:notice] %>
  </div>
<% form_remote_tag :url => { :controller => 'login', :action => 'login' } do %>
  <div class="container" id="login_button">
    <%= submit_tag 'Login' %>
  </div>

  <div class="container" id="login_password">
    <label for="password">Password:</label>
    <%= password_field 'user_store', 'password', :size => 10, :tabindex => 2 %>
  </div>

  <div class="container" id="login_user_name">
    <label for="name">Username:</label>
    <%= text_field 'user_store', 'name', :size => 10, :tabindex => 1 %>
  </div>
<% end %>

## _logout.rhtml [ruby]
<div class="text" id="logout_inline">
  <% link_to_remote 'Cancel', :url => { :controller => 'login', :action => 'show_login_index' } %>
</div>
<div class="form" id="inline_logout">
  <% form_remote_tag :url => { :controller => 'login', :action => 'logout' } do %>
    <%= submit_tag 'Logout' %>
  <% end %>
</div>