I haven't been using C::A for too terribly long, but so far, it's been a blessing to my web development efforts ;) Your approach to this is not too dissimilar to my own:

My applications have a lot in common, from configuration files to session parameters to application parameters. Typically, when one of my apps needs to handle a login, they simply redirect to my user module as follows:

    # Are we logged in?  If not, redirect someplace sane!
    unless(user_is_logged_in())
    {
        $self->param("session")->param("login_redirect", $request->url
+ . "?mode=modify");

        # Redirect!
        $self->header_type("redirect");
        $self->header_props(-url => "/cgi-bin/users.cgi?rm=login");
        return "Please wait. . .";
    }
[download]

Notice the login_redirect param. Login uses this to decide where to send the user upon a successful login.

My login handling code then looks like this:

    # Check for username and password
    my $username = untaint_string($request->param("username")) || "";
    my $password = untaint_string($request->param("password")) || "";

    # Perform the login?
    my $page;

    if($username ne "")
    {
        # Log them in!
        my $check_user = user_login($username, $password);

        # Check login status
        if($username eq $check_user)
        {
            # Set session parameters
            $self->param("session")->param("is_logged_in", "Y");

            # Where do we redirect upon success?
            my $redirect = $self->param("session")->param("login_redir
+ect");
            $redirect = $config{URL_BASE} unless($redirect ne "");

            # Redirect!
            $self->header_type("redirect");
            $self->header_props(-url => $redirect);
            return "Please wait. . .";
        }
        elsif($username eq "INACTIVE")
        {
            $self->param("error", "This account is currently inactive.
+");
            $page = $self->login();
        }
        else
        {
            $self->param("error",
                "Invalid user/password combination.  Please enter a ne
+w username and password.");
            $page = $self->login();
        }
    }
    else
    {
        $self->param("error", "Invalid user/password combination.  Ple
+ase enter a new username and password.");
        $page = $self->login();
    }

    return $page;
[download]

Some of these functions are from my own application code, but you should get the gist of what is going on.

Sorry that I am unable to answer your question with regards to bloat. I'm not the best at profiling an application :(

Hope this helps you somewhat and answers your questions. Feel free to bombard me with your questions.

Good luck!
MrCromeDome