This element is optional, and is specified only when using form-based authentication (ie: the <auth-method> value is set to FORM).
There are two required subelements:
- <form-login-page> - the login page, where users are sent if they attempt to access a protected resource before logging in
- <form-error-page> - the login error page, where users are sent after unsuccessful login attempts
