One of the reasons WordPress is awesome is that it comes with its own fully functioning user authentication system. Writing that from scratch these days would be pretty dumb if you don't plan to bring a heaping pile of innovation to the process.
Restrict Content Pro, our membership plugin, of course doesn't re-invent the wheel. It just extends what the WordPress user system does by appending subscriptions to users.
So when we set out to add a login form for our users, we're essentially just exposing the WordPress login in our template rather than redirecting them to /wp-login.php - which is the default. The function wp_login_form() is what we need.
We use a bit of logic about when to show it. If a user is logged out, they get a login form. If they are logged in, they get a "Welcome Back!" module instead.