Yes, you can do such a thing. I have a same phase listener:
@Override
public PhaseId getPhaseId() {
return PhaseId.RESTORE_VIEW;
}
@Override
public void beforePhase(PhaseEvent event) {
FacesContext ctx = FacesContext.getCurrentInstance();
if (!ctx.isPostback()) {
authRet = // check for active session
if (!authRet) {
if (...)// check for cookies { //create auth}
else { // redirect to login }
}
}