Fixed potential XSS issue with the username-less login mode.