Turned on HTML escaping and altered the logged_in condition a bit.
Fixed a naming conflict.
Added a current_login_hash helper.