Login properly accounts for non-verified users... authToken === null;
built in form validation js.
Filtered POST'd vars in line
Brought in CSRF.