title: Login/Authorization best practices in a PHP MVC environment
body: <p>I am working with a homebuilt MVC-oriented framework, and need to implement a login page.</p>
  
  <p>At the moment, the way it works is each controller that needs authorization calls its <code>authorize()</code> method, which in pseudo-code looks like:</p>
  
  <pre><code>protected function authorize() {
      if (logged in) {
          return true;
      }
      if (login form submitted) {
          authorize/validate username/password
          if (!valid) {
              render login form
              return false;
          } else {
              mark user logged in
              return true;
          }
      } else {
          render login form
          return false;
      }
  }
  </code></pre>
  
  <p>I would like to move this logic to its own LoginController, but that would require 'remembering' where the original request was to, and saving all POST and GET data, then doing a redirect to get to the LoginController.</p>
  
  <p>What is the best way of logging a user in, in regards to good MVC design, and the KISS principle?</p>