for now, add a note about the 302 CORS/AJAX symptom of bad ACO/ARO data
add label to login form to clarify that email or username is ok