Modularize the redirect-to-certs kludge so that users just need to say 'ErrorDocument 401 /__scripts/needcerts'.