play auth pseudocode

Application.scala

class Application extends Controller {
  case class LoginData(user: String, pass: String)
  private val loginFormConstraints = Form(mapping("user" -> nonEmptyText, "pass" -> nonEmptyText))(LoginData.apply)(LoginData.unapply)

  def showLogin = Action {
    OK(views.html.login)
  }

  private def authenticate(user: String, pass: String): Future[AuthResponse] = ???

  def doLogin = Action.async { implicit request =>
    loginFormConstraints.bindFromRequest.fold(
      formWithErrors => Future successful BadRequest(views.html.login),
      loginData => {
        val user = loginData.user
        val pass = loginData.pass

        authenticate(user, pass) map {
          case BadAuth() => BadRequest(views.html.login)
          case GoodAuth(sessId) => Redirect(routes.Application.index) withSession ("sessionId" -> sessId)
        }
      })
  }

  private def closeSession(sessId: String): Future[Unit] = ???
  private def getSessionId(implicit request: RequestHeader): Option[String] = request.session.get("sessionId")
  private def backendAuthIsValid(sessId: String): Future[Boolean] = ???
  private def backendCloseAuth(sessId: String): Future[Unit] = ???
  private def isSessionValid(implicit request: RequestHeader): Future[Boolean] = {
    getSessionId match {
      case None => Future successful false
      case Some(sessId) => backendAuthIsValid(sessId)
    }
  }

  def logout = Action.async { implicit request =>
    getSessionId match {
      case None => Future successful Redirect(routes.Application.index)
      case Some(sessId) =>
        backendCloseAuth(sessId) recover {
          case t: Throwable => 
        } map {
          case _ => Redirect(routes.Application.index).withNewSession
        }
    }
  }

  def index = Action.async { implicit request =>
    isSessionValid map {
      case false => Redirect(routes.Application.showLogin)
      case true => Ok(views.html.index)
    }
  }

  def webSocket = {
    WebSocket.tryAcceptWithActor[String, String] { request =>
      isSessionValid(request) map {
        case false => Left(Forbidden)
        case true => Right(MyActor.props)
      }
    }
  }
  
}

routes

GET         /login                controllers.Application.showLogin
POST        /login                controllers.Application.doLogin
GET         /logout               controllers.Application.logout

GET         /webSocket            controllers.Application.webSocket

# Map static resources from the /public folder to the /assets URL path
GET         /assets/*file         controllers.Assets.at(path="/public", file)

GET         /webjars/*file        controllers.WebJarAssets.at(file)

GET         /                     controllers.Application.index