Validate the login failure redirect path

Currently the login failure redirect path is just a free text field. This adds in validation so that it has to be a real path.