add autocomplete="off" for password fields
add more route contraints
prevent multiple  invalid encoding attacks
validate return uris on login / logout