Fixed Cross Site Scripting issue with login.php form posting (may be a false positive).

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> apparently causes XSS!