The login page is now redirected to by the XHTML Unauthorized page, and knows to return to the right URL when authentication succeeds. It also means that we no longer return a 200 with login page content for a totally unrelated page...
Some of the user stuff (disabling, Tos, etc.) is now broken, and /logout moved to /+logout.