Your login form is susceptible to a trivial XSS attack. The content of the username field when posting an invalid username/password pair is embedded in the resp

Your login form is susceptible to a trivial XSS attack. The content of the username field when posting an invalid username/password pair is embedded in the response and is not escaped at all. You should get someone to take a serious look at the security of your site.