Mask codename

Fixes #525

Allow sources the option to log in with a new route, login_masked, which does not reveal their codename as they are typing it in.

Masks the codename on the submission page, revealing it with text select.