Moved configuration of passive and forced auth to the constructor of the
LoginHandler rather than per request