Login page enhancements

- Default to secure cookies (in case var is not defined in config.php)
- Enable content security policy
- Return HTTP 401 response code for invalid username/password combinations

js/login_prevent_resubmit.js

@@ -0,0 +1,3 @@
+if (window.history.replaceState) {
+    window.history.replaceState(null,null,window.location.href);
+}