Move the login machinery to the new framework.
The login page is now redirected to by the XHTML Unauthorized page, and knows
to return to the right URL when authentication succeeds. It also means that we
no longer return a 200 with login page content for a totally unrelated page...
Some of the user stuff (disabling, Tos, etc.) is now broken, and /logout moved
to /+logout.