There's nothing to prevent your controllers from knowing about each other through dependency injection. E.g.
Code:
public class LoginController implements Controller {
private Controller startingController; // setter ommitted
public ModelAndView handleRequest(...) {
...
if (unsuccessful) {
return startingController.handleRequest(...);
}
return ...;
}
}
But that's also not the only way to implement this kind of rule (e.g. Spring Security uses a ServletFilter to detect and redirect on unsuccessful authentication).