Login now provided by a POST form rather than an ajax request.

The ajax request was only a temporary fix because of the csrf_token bug. Now /authenticate-user will either redirect to ?next= in the event of a successful authentication, or redirect back to /login.html?auth_fail=1 which will then give a message to the user and a 403.