o Do not keep the login error in the session for
  reloading the page without resubmit will yield
  a spurious login error.

o Pad and reword the message and paint it black,
  eh, red.