login/out: (hope)fully close phishing hole

Follow-up to 27758d5f11d1afb6f0565a42261aba1474e07f56 and ed5021ad191d618635a4d932f121b664b3447240.

This should probably be read from a property in `config.js`, but you get the idea.