There's no redirect, however. The URL remains the same, but the default login form is rendered right there. I can see some logic in that behaviour because the login form then knows the requested page and can redirect back there after login.
As a temporary measure, I have edited the login form template to hard-code the full URL of the forum's login script - so now the login form posts to the correct URL, and redirects back to the original requested page after. That at least gets things working with most of the behaviour they want.
I'm still curious as to how to use global.php and $vbulletin->userinfo['userid'] to check logged-in status as it seems to be commonly discussed as a means of sniffing user logged-in status outside the forum.
I have to show a login/logout pop on non forum pages, so when I include global.php to sniff the logged-in status, I get the same problem of the login form being rendered.
I'll mess around with plugins and debug, it's bound to give me some insight, though I don't see any that immediately suggest they relate to rendering of a login form.
I haven't had to play with the hooks until now, so that should be fun
Thank you for the suggestions.