public ActionResult Login()
{
    return View();
}

[HttpPost]
public ActionResult Login(LoginModel model, string returnUrl)
{
    if (!ModelState.IsValid)
        return View(model);

    var password = PasswordHash.Encrypt(model.Password);

    var user = _userManagerService.GetUser(model.Username, password);

    if (user != null)
    {
        FormsAuthHelper.SetAuthenticationCookie(Response, user);

        if (returnUrl.Length > 1)
        {
            return Redirect(returnUrl);
        }

        return RedirectToAction("Index", "Invoice");
    }

    ModelState.AddModelError("", "The user name or password provided is incorrect.");
    // If we got this far, something failed, redisplay form
    return View(model);
}

public class AutorizedOnly : AuthorizeAttribute
{

    private const string LOGIN_URL = "~/Accounting/Login";

    public override void OnAuthorization(AuthorizationContext filterContext) {
        base.OnAuthorization(filterContext);

        if (/*is NOT autorized*/) {
            Uri returnTo = filterContext.HttpContext.Request.UrlReferrer;
            filterContext.Result = new RedirectResult(LOGIN_URL, new { returnUrl = returnTo });
        }
    }
}


public class Accounting : Controller {
    ...

    public IActionResul Login(Uri returnTo, SignInModel model) {
        if (ModelState.IsValid) {
            if (/*login success*/) {
                /* Set cookie with session id */
                return Redirect(returnTo.ToString());
            }
        }
        ...
    }

    ...
}