Kano,
I'm sure you're already aware and you have your reasons, but have you thought about utilizing CloudFlare? They offer unlimited DDOS mitigation and their CDN might take a little load off the server. Anyway, it might make it so you don't have to remove login functionality while the DDOS is in effect.
Firstly, Cloudflare wont help,
... and I'd have to give them control of my SSL certificate which no one in their right mind would do
who has a site that deals with something of great value.
and of course when was the last time you noticed a DDoS on my web site ... they aren't rare, just rarely have an effect

In this case I just have a command I wrote to deal with it, that doesn't stop anyone using the site except logging in.