SECURITY: Don't return username from AutoLogin

A malicious website can include a <script
src="https://<wiki>/Special:CentralAutoLogin/start" /> on their site,
and the CentralAuth login script will update that hostile page with
the user's logged-in username. This could allow an attacker to match
IP and Username of a user.

This gets the user's name (in the toolslist header) via ajax, which
browsers will forbid unless the page has SOP with the wiki.

Bug: 57081
Change-Id: I8285b26e9394a6c1d504e5b2ea27356198237528