Undelete the login() call inadvertantly removed in 4e0a2fe59c

Refs #21271.
Fixed typo in docs/releases/1.4.9.txt.
Fixed #21325 -- Added missing argument to permission_required decorator.