Update login.ztml

XSS fixes.

If form action is empty, the target is self script. PHP_SELF not needed.