show mobile login on mobile clients

also, if user access urls starting with /m/, even though it's not a mobile
client, we also show the mobile login.
mimic the login error message for mobile login
basic login test
Don't let the NotMobile query param trigger CSRF

Otherwise clicking the "Not a mobile browser?" link can trigger CSRF
warnings.
Preserve page anchors on the mobile login as well

Ported from 9a57c79, without the use of jQuery.  Requires always
submitting to /NoAuth/Login.html instead of the old dynamic form action
logic.  That's OK because Login.html now renders the mobile login page
if necessary.  The dynamic form action logic was previously removed from
the main /Elements/Login during the original login reworking.
Inform the user logging in about potential side-effects on mobile login too

Ported from 5d56935.
Only preserve the next and mobile query params on mobile login

Preserving the rest is a relict of the previous login behaviour without
redirects.
Move /m/login into /m/_elements/ for consistency with /Elements/Login
Merge branch '4.0/mobile-login' into 4.0-trunk