Ah! It is all starting to hang together. Of course, as my Granddad used to say (ad nauseum) - "when all else fails, read the instructions". Now that I have started to understand the inheritance structure of the model it becomes obvious that changing the template associated with the default page class will change any pages that render according to that default - and the security_login page would be a high probability candidate.
I must add that the MVC is so elegantly constructed that I am quite envious - lots of "why didn't I think of that" moments. Nice work dudes!