class MyController {

    def beforeInterceptor = [action: this.&checkUser, except: ['index', 'show', 'showCake']]

    // the delete, save and update actions only accept POST requests
    def allowedMethods = [/*delete:'POST', */add:'POST',update:'POST',edit:'GET']

    def checkUser() {
        println "actionUri: ${actionUri} params ${params}"
        if (!session.user) {
            // i.e. user not logged in
            session.originalUri = actionUri
            session.originalUriParams = params
            redirect(controller: 'user', action: 'login')
            return false
        }
    }



class UserController {
    def securityService

    def login = {}

    def doLogin = {
//        def user = User.findWhere(login: params['login'],
//                password: params['password'])
        def userId = securityService.authenticate(params['login'], params['password'])
        def originalUri = session.originalUri
        def originalUriParams = session.originalUriParams
        println "*** doLogin ${userId} to ${originalUri} with ${originalUriParams}"

        if (userId) {
            session.user = userId
            session.originalUri = null
            session.originalUriParams = null
            if (originalUri) {
                if (originalUriParams.id) {
-->                 redirect(uri: originalUri, id:originalUriParams.id, params:originalUriParams)                    
                } else {
                    redirect(uri: originalUri, params:originalUriParams)
                }
            }
            else
              redirect(controller: 'cake', action: 'list')
        }
        else
            redirect(controller: 'user', action: 'login')
    }