Good question. I was fiddling with the code at the last minute and I made one of the classic mistakes -- putting a naked 'shift' into a hash parameter. So my login_required function, as written, didn't work, but (subsequent to breaking it) I hadn't tested the case of the user trying an end run around logging in by going to a run mode that required it.

I've updated the code, and maybe my prerun makes more sense now that it's governed by a function that actually works.

Updated: I wasn't really addressing all the questions, so I added the following...

The example with the desired_runmode you mention does something nice that this example doesn't -- if the user's not logged in (perhaps because his or her session expired), it directs them to the login screen, while remembering where they wanted to be, and directing them there after they're logged in. That's functionality that just isn't here -- here, when they log in, they go to main, period. (Of course in this example there's literally nowhere else to go.)

My prerun returns without action if they're going to a run mode that doesn't require being logged in, e.g. the login and create account run modes and the run modes that process the submission of those forms. Then, having determined they're going to a run mode that does require being logged in, it checks if they're logged in, and returns without action if they are. Finally, having eliminated the above cases, it knows that the user is going to a run mode that requires being logged in, and that the user is not logged in, so it directs the user to the login screen.

I am a CGI::Application beginner myself, and have no idea why someone would say something actually required splitting the application into multiple C::A's. Can you provide a link to that assertion?