login form tuning

- autofocus
- return status 400 if username is malformed or missing
- add test cases