fix login form, and allow a couple of parameters to be overridden in web.xml