Your login form is susceptible to a trivial XSS attack. The content of the username field when posting an invalid username/password pair is embedded in the response and is not escaped at all.

You should get someone to take a serious look at the security of your site.