Fix login redirect, combine forbidden view and login view

The login view is now also the forbidden view, this behaviour is more how the original lwp worked.

This means when not logged in, going to /about will show the login screen on that URL, rather than do a redirect to /login.

Also used same variable in form for return url as original lwp.