Sorry, that is impenetrable ;;; even with a live system to play with

This part

    unless ( $class->valid_password($username, $password, $r)) {
        unset_cookie($r);
        return login_form($r);
    }
[download]

says show login form unless username/password is valid (like any one of the two is empty)

Then immediately after that the same logic is repeated

Basically you need to contact whomever is supporting this application