dispatch/login.py: When displaying the login page, returns a 200, not a 403 Forbidden. This is because "Forbidden" has the wrong semantic - it means "you will never get in here even if you auth", whereas we want to present the opportunity to auth. Some user agents interpret a 403 as defeat, and don't even present the page body.