Make failing auth handlable.

Can now set successRedirect (instead of defaultRedirect), and
failedRedirect (new).

So we can make failedRedirect go to the product signup page, or whatever now, instead of falling into an infinite loop.