Following the experience of debugging the issue in #23, Spencer suggested that:
- We should log login failures, somehow
- We should send login failures to a page that says something other than "OK"
This should mostly be a matter of creating a suitable view and pointing LOGIN_REDIRECT_URL_FAILURE to it.