Replace image-based AutoLogin with silent iframes

The image-based Special:AutoLogin is not secure. Change to an
iframe-based method (using the same code as the js login check) instead.

And, on request, make the redirect-through-central-domain a 302 instead
of a JavaScript post, and make these iframes load silently on an
arbitrary pageview after the login rather than on a login success
screen.