#2949 added XSS protection on login forms