really quick and not the best place to put a more friendly login message...

....

without having an explicit way to detect session expiration in our login/logout redirection, using next param as way of determining intent.

on an expired or nonexistent session, next= will show up on url redirect.