move login redirection out of login controller to allow overrides