Replace image-based AutoLogin with silent iframes

The image-based Special:AutoLogin is not secure. Change to an
iframe-based method (using the same code as the js login check) instead.

And, on request, make these iframes load silently on an arbitrary
pageview after the login rather than on a login success screen.