XSS in the login page

The error parameter in the login page is not protected against xss.