Login controller and views

AccountController.cs

using System;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using BL;
using DAL.Models.Identity;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using OpenWeather.ViewModels;

namespace OpenWeather.Controllers
{
    public class AccountController : Controller
    {
        private readonly UserManager userManager;
        private readonly SignInManager<User> signInManager;

        public AccountController(UserManager userManager, SignInManager<User> signInManager)
        {
            this.signInManager = signInManager;
            this.userManager = userManager;
        }

        [HttpGet]
        public IActionResult Login(string returnUrl = "/")
        {
            ViewData["ReturnUrl"] = returnUrl;

            return View();
        }

        [HttpPost]
        public async Task<IActionResult> Login(LoginViewModel vm, string returnUrl = null)
        {
            if (ModelState.IsValid)
            {
                try
                {
                    // Get user info from token
                    var result = await signInManager.PasswordSignInAsync(vm.EmailAddress, vm.Password, false, false);
                    if (result.Succeeded)
                    {
                        var user = await userManager.FindByEmailAsync(vm.EmailAddress);
                        var roles = await userManager.GetRolesAsync(user);

                        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity(new[]
                            {
                                new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
                                new Claim(ClaimTypes.Name, user.UserName),
                            }.Concat(roles.Select(role => new Claim(ClaimTypes.Role, role)).ToArray()),
                            CookieAuthenticationDefaults.AuthenticationScheme));

                        // Sign user into cookie middleware
                        await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
                            claimsPrincipal);

                        return RedirectToLocal(returnUrl);
                    }
                }
                catch (Exception e)
                {
                    ModelState.AddModelError("", e.Message);
                }
            }

            return View(vm);
        }

        [Authorize]
        public async Task<IActionResult> Logout()
        {
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            return RedirectToAction(nameof(HomeController.Index), "Home");
        }

        public IActionResult AccessDenied()
        {
            return View();
        }

        [Authorize]
        public IActionResult Claims()
        {
            return View();
        }

        private IActionResult RedirectToLocal(string returnUrl)
        {
            if (Url.IsLocalUrl(returnUrl))
            {
                return Redirect(returnUrl);
            }
            else
            {
                return RedirectToAction(nameof(HomeController.Index), "Home");
            }
        }

        [Authorize(Roles = "Admin")]
        public IActionResult SecretView()
        {
            return View("OnlyForAdmin");
        }
    }
}

Login.cshtml

@model OpenWeather.ViewModels.LoginViewModel
@{
    ViewData["Title"] = "Log In";
}

<div class="row">
    <div class="col-md-4 col-md-offset-4">
        <section>
            <form asp-controller="Account" asp-action="Login" asp-route-returnurl="@ViewData["ReturnUrl"]" method="post">
                <h4>Log In</h4>
                <hr />
                <div asp-validation-summary="All" class="text-danger"></div>
                <div class="form-group">
                    <label asp-for="EmailAddress"></label>
                    <input asp-for="EmailAddress" class="form-control input-lg" />
                    <span asp-validation-for="EmailAddress" class="text-danger"></span>
                </div>
                <div class="form-group">
                    <label asp-for="Password"></label>
                    <input asp-for="Password" class="form-control input-lg" />
                    <span asp-validation-for="Password" class="text-danger"></span>
                </div>

                <div class="form-group">
                    <button type="submit" class="btn btn-success btn-lg btn-block">Log in</button>
                </div>
            </form>
        </section>
    </div>
</div>