With repoze.who-friendlyform you have full control on successful/unsuccessful logins:
http://code.gustavonarea.net/repoze.who-friendlyform/

Where an application has a login panel on every page, this panel is often not
large enough to display errors. A successful login may opt to keep the user on
the same page but a failure should take the user to the full login page so that
a user can be shown 'password reminder' options and also an appropriate error
message. At the moment there seems to be no way to conditionally set
repoze.who.application depending on success or failure (as we have only one
authenticator, we can get away with changing the environ in the authenticate
method but this would not work if there were more than one authenticator).