AuthHandlers.hs

routes = [ ("login", with auth loginHandler)
         , ("register", with auth registerHandler)
         , ("logout", with auth logout >> redirect ".")
         ]

passParam paramName = maybe pass return =<< getParam paramName

loginHandler = do
    username <- passParam "username"
    password <- passParam "password"
    res <- loginByUsername username (ClearText password) False
    redirect "/"


registerHandler = do
    username <- passParam "username"
    password <- passParam "password"
    password2 <- passParam "password2"
    if password == password2
      then do createUser (T.decodeUtf8 username) password
              res <- loginByUsername username (ClearText password) False
              redirect "/"
      else writeText "Passwords do not match"

login.tpl

<form method="POST" action="login">
  <div>
    <h1>Log in</h1>
    <div>
    <input name="username" placeholder="username" type="text"/>
    </div>
    <div>
    <input name="password" placeholder="password" type="password"/>
    </div>
    <br/>
    <div>
    <input name="action" value="Log In" type="submit"/>
    </div>
  </div>
</form>

<form method="POST" action="register">
  <div>
    <h1>Register</h1>
    <div>
    <input name="username" placeholder="username" type="text"/>
    </div>
    <div>
    <input name="password" placeholder="password" type="password"/>
    </div>
    <div>
    <input name="password2" placeholder="confirm password" type="password"/>
    </div>
    <br/>
    <div>
    <input name="action" value="Register" type="submit"/>
    </div>
  </div>
</form>