Scripts must be enqueued on the login page as well.
error and failed both must be escaped, they are printed to the DOM.