I don't think that's a good idea to have a default here. I expect `options.SPA.loginURL` to be properly set every time (like `ROOT_URL` ?)