The value of config['auth_login'] is used for both failed and successful logins.
So, if you try to access some controller without being authenticated for it , you're redirected to config['auth_login'], but naturally, you're not authenticated for that either, so it redirects you .. to config['auth_login']. and so forth.
Similarly, I added a redirect based on the user's group settings at the end of the login() function. Again there is trouble because of the group/group_id issue. Around line 143: