Thanks Victoria - yeah, this is the only way I've found I could do it.  However, I think we're going to add our own Apache instance in our deployments so we can have a bit more control.  

Thank you @Heloisa Paiva.  Your idea of BP in front of a call to login should work out fine.  I'm marking this as 'resolved' and will post the actual outcome once we've had a chance to implement it.

Thanks.  I really want to leverage the 'built in' /login, how do I add in a BP in front of it?  I'm really trying to avoid  'rolling our own' authentication logic.