I implement logins using returns and if you have properly factored your code so each run-mode doesn't do more than it absolutely needs to, there's no problem. Remember - until the user has successfully logged in, the user can only see one page - the login screen. So what if they hit reload?