When I need to share authorization code between different C::A applications, I put the necessary code in the cgiapp_prerun() method of a base module; then every application use that module and inherits everything needed, including some common run modes (i.e. login, login_failed, etc). BTW, this is also the suggested solution in CGI::Application documentation.
The following is a stripped down example from my code:

package MyApp::Base;
use base 'CGI::Application';
sub cgiapp_init {
  my $self = shift;

  # init your application: session, database, whatever is needed
  ...

  # set the name of the run mode CGI param
  $self->mode_param('rm');

  # shared run modes
  $self->run_modes('login'    => 'login',
                   'AUTOLOAD' => 'autoload_exception');

  return;
}

...
sub session { return shift->param('SESSION'); }
...

sub cgiapp_prerun {
  my $self = shift;
  my $runmode = shift;
  my $user = $self->session->param('user');
  unless ($user) {
    $self->prerun_mode( 'login' );
  }
}
[download]

package MyApp::Application1;
use base 'MyApp::Base';
...
[download]

I haven't been using C::A for too terribly long, but so far, it's been a blessing to my web development efforts ;) Your approach to this is not too dissimilar to my own:

My applications have a lot in common, from configuration files to session parameters to application parameters. Typically, when one of my apps needs to handle a login, they simply redirect to my user module as follows:

    # Are we logged in?  If not, redirect someplace sane!
    unless(user_is_logged_in())
    {
        $self->param("session")->param("login_redirect", $request->url
+ . "?mode=modify");

        # Redirect!
        $self->header_type("redirect");
        $self->header_props(-url => "/cgi-bin/users.cgi?rm=login");
        return "Please wait. . .";
    }
[download]

My login handling code then looks like this:

    # Check for username and password
    my $username = untaint_string($request->param("username")) || "";
    my $password = untaint_string($request->param("password")) || "";

    # Perform the login?
    my $page;

    if($username ne "")
    {
        # Log them in!
        my $check_user = user_login($username, $password);

        # Check login status
        if($username eq $check_user)
        {
            # Set session parameters
            $self->param("session")->param("is_logged_in", "Y");

            # Where do we redirect upon success?
            my $redirect = $self->param("session")->param("login_redir
+ect");
            $redirect = $config{URL_BASE} unless($redirect ne "");

            # Redirect!
            $self->header_type("redirect");
            $self->header_props(-url => $redirect);
            return "Please wait. . .";
        }
        elsif($username eq "INACTIVE")
        {
            $self->param("error", "This account is currently inactive.
+");
            $page = $self->login();
        }
        else
        {
            $self->param("error",
                "Invalid user/password combination.  Please enter a ne
+w username and password.");
            $page = $self->login();
        }
    }
    else
    {
        $self->param("error", "Invalid user/password combination.  Ple
+ase enter a new username and password.");
        $page = $self->login();
    }

    return $page;
[download]

Sorry that I am unable to answer your question with regards to bloat. I'm not the best at profiling an application :(

Hope this helps you somewhat and answers your questions. Feel free to bombard me with your questions.

Good luck!
MrCromeDome

  # In WebApp.pm:
  package WebApp;
  use base 'CGI::Application';
  sub cgiapp_prerun {
        my $self = shift;

        # Get the web user name, if any
        my $q = $self->query();
        my $user = $q->remote_user();

        # Redirect to login, if necessary
        unless ($user) {
                $self->prerun_mode('login');
        }
  }
[download]

Your example is wrong: if you are going to use remote_user information from CGI.pm, then you will never reach that prerun mode without a valid user and the code unless ($user) ... is useless.

Ciao, Valerio

Update: Fixed broken link.