fixes #10 - retain querystrings around login, move login form error messages to seesion rather than GET