Make CentralAuth login more silent

The image-based Special:AutoLogin is not secure. Change to an
iframe-based method (using the same code as the js login check) instead.

While we're at it, we can change the redirect-through-central-domain to
a 302 instead of a JavaScript post (I'm told Safari 5 users aren't a
concern) and make these iframes load silently on the pageview after the
login rather than on a login success screen.
Rewrite p-personal on successful central login check

It has been decided we should do this, and hope that the discrepancies
between this and a real login don't cause users any confusion.