I probably misused the _SESSION. A month of php only got you this far. Fixed on the last commit.

The reason I use a variable to carry over the error message instead of adding the error directly to the $data array is because if I don't, then the first time the login page is loaded the empty_not_allowed value is taken and displayed.