i use kfm as login for my own cms and i only had to made one tiny change in login.php:
instead of
< form method="post" action="./" >
i use
< form method="post" action="< ? php echo $_SERVER['PHP_SELF']; ? >">
with this mod i can embed kfm in my php
require_once PATH_TO_KFM.'/initialise.php'; echo $kfm_session->get('username'); ....
i suggest, that you change this in your code.
Or do you see any risk with that?