rework routes to appear as single page app

- if login page needed, login page delivered, but
  client not redirected to different path
- if login page requested, client redirected to
  root, which will deliver login page if needed