I'm not sure I explained it correctly in the question title, so here's the details:

Login controller:

function authenticate() {
    if ( authorized ) {
        redirect('lobby');
    } else {
        redirect('login');
    }
}

Lobby controller:

function index() {
    //load lobby view
}

What happens is that in the login page, I enter user / pass, click Login, then authenticate() is called, and redirects me to the Lobby.

However, when I click refresh while on the Lobby, the login form gets submitted again, so I get "logged in" again. How do I prevent that from happening?