Sure, it's possible to put it all in the same file; you'd just need to
create an if statement testing if the request method is post, or if
they're already logged in; if not, it'll output the form instead.
Also, you need to add exit; after any header('location: ......');
changes, otherwise the script will still contine to execute.