Make CentralAuth login more silent

The image-based Special:AutoLogin is not secure. Change to an
iframe-based method (using the same code as the js login check) instead.

While we're at it, we can change the redirect-through-central-domain to
a 302 instead of a JavaScript post (Safari 5 users aren't a concern) and
make these iframes load silently on the pageview after the login rather
than on a login success screen.