(use awful http-session spiffy-cookies)

(define-app login
  matcher: identity
  parameters: ((enable-sxml #t))

  (define (define-my-page path content)
    (define-page path
      (lambda ()
        (sid (read-cookie (session-cookie-name)))
        (if (and (sid) (session-valid? (sid)))
            (content)
            (redirect-to (login-page-path))))))

  (define-my-page (main-page-path)
    (lambda ()
      '(p "Hi")))

  (define-page (login-page-path)
    (lambda ()
      (with-request-variables ((user (nonempty as-string))
                               (password (nonempty as-string)))
        (if (and user password (equal? user password)) ;; strong security
            (begin
              (sid (session-create))
              ((session-cookie-setter) (sid))
              (redirect-to (main-page-path)))
            `(form (@ (action "/login")
                      (method "post"))
                   (input (@ (type "text") (name "user")))
                   (input (@ (type "password") (name "password")))
                   (input (@ (type "submit")))))))
    method: '(GET POST))
  )