customize logged_out form: do not allow direct login from the logged_out form,
but link to the login form. Prevents "fake login" issue in combination with varnish