Its been awhile since i dipped that deep, but if i recal correctly the security fowarding in Symfony uses an internal foward so that the server doesnt have to handle an entirely new request. When you use an internal forward like this the URL will not change, because as far as the client is concerned you are still at the same URL you initially requested.
You would need to create your own Security filter to replace the default sfBasicSecurityFilter i believe, and then you would also probably need to modify any instances in actions or elsewhere that use forward in response to invalid/non-existent credentials.
I dont think there is an easy way to do this, and honestly its not advisable if you do. There are probably other solutions to what you need to acheive... Why do you need the URL to change?