Move the account login uri into a config definition.

Sites can use this to customize the location of the login page without having to subclass all pages that redirect to it when not logged in.
this is broken: an `sprintf`inside an `sprintf