allow specifying a login success url in the settings file - dont error if setting is not present. also make sure viewdata is refreshed on each request