Editing Secure login (section)

===Caveats===
The login process now works as follows.
# when a page requires authentication, it creates a "login page" with destination at the secure web site
# data entered to the "login page" is sent encrypted to the secure site
# the secure site encrypts the payload, and redirects the browser to the unencrypted eprints page ''receive_data''
# ''receive_data'' decrypts the payload, checks credentials, logs in the user if everything checks, and then redirects the browser to the originating page.

What is lost in this process of two redirects is the error message when authentication fails. ''Receive_data'' cannot display the error message as its URL should not be displayed on the user's screen. The final page - which is the original one as well - cannot distinguish between an unsuccessful login and a reload, thus cannot display the error message as well. ''[http://en.wikipedia.org/wiki/C'est_la_vie C'est la vie]''.

The encrypted data the ''receive_data'' page receives can be a replay of a sniffed older communication. Thus this data should contain a timestamp which should be checked to be recent. It also means that '''the secure and eprint servers must synchronize their clocks'''.

The secure site can also check the credentials, and relay the result only. Interestingly, the result should be sent encrypted, as otherwise the secure site could be used as an [http://en.wikipedia.org/wiki/Oracle oracle] to tell whether the password is correct or not (ideal utility for a [http://en.wikipedia.org/wiki/Dictionary_attack dictionary attack]).