I can't figure out why you are still confused by this. Just because the user fills out the form first, and then is authenticated second, does not mean that the code has to implement those steps in that order.

## pseudocode:

if ( have user credentials )
{
  if ( credentials are valid )
  {
    redirect  # see note 1
    exit
  } else {
    record error details
  }
}

print headers

print error details
  if ( error details )

print form
[download]

Given the confusion the modal nature of your design seems to be causing you, I would recommend making the form and the validation different scripts.

note 1: make sure that your landing page inspects the credentials, etc. In your code you are redirecting to a URL with the username, etc. embedded. Obviously the landing page needs some sort of authentication too.