rewrite login in index.xhtml, redirect to index.jsf instead of login 
added lost password function - still needs email notifications