So, the good news is that this approach totally works and is more-or-less a direct translation of what we did with Gallery 3.0.x.

The bad news is that I think it's now a bit *too* easy for a user to accidentally screw something up with a before() function.  Example:
```php
  public function before() {
    parent::before();
    $foo =  $this->request->arg(0);
    if ($foo == "bar") {
      // Redirect bar to its special action
      $this->request->action("bar");
    }
  }
```
This seems like a reasonable thing for someone do to, but can override the fact that we may have already redirected the action to show_login.  Bummer.

So, quick background: the issue is that we need to do *something* here to stop the controller from executing the normal action.  I can think of three decent options:
- Change the action to something else.  This is what I did here, and allows me to use a sub-request that doesn't redirect the browser.
- Throw a redirect.  This throws an HTTP_Exception, which halts the script.  I could do this by moving the action_show_login() code into before() and just redirect everyone to the login URL.  We can still keep the continue_url functionality.  This is the approach most commonly found in Google searches of Kohana auth examples.
- Tweak how Controller::execute() works.  This is the routine that calls before, action, and after.  For example:
```php
  public function execute() {
    $result = $this->initialize();
    if (!$result) {
      // Halt controller action and return.
      return;
    }
    parent::execute();
  }
```
Then, we put all of our auth and security code in initialize(), where it is *totally* immune from before() functions, and have it return true if the controller should continue and false if not.

Thoughts?