Write an ‘alert’ helper 

post '/login' => sub {
    my $user = password_valid( param('username'), param('password') );
    if( $user ) {
        session username => $user->username;
        session is_admin => 1 if $user->admin;
        return redirect '/';
    }
    alert 'Invalid username or password', span => 4, offset => 4;
    template 'login';
};