anchor.diff:              errors.put("unauthorized", LocaleUtils.getLocalizedString("login.failed.unauthorized"));
           }
       }
  +
  +    // Escape HTML tags in username to prevent cross-site scripting attacks. This
  +    // is necessary because we display the username in the page below.
  +    username = org.jivesoftware.util.StringUtils.escapeHTMLTags(username);
  +
   %>
   
   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
  
positive.code: 
  <% // get parameters
      String username = ParamUtils.getParameter(request, "username");
      if (username != null) {
          username = JID.escapeNode(username);
      }
      // Escape HTML tags in username to prevent cross-site scripting attacks. This
      // is necessary because we display the username in the page below.
      username = org.jivesoftware.util.StringUtils.escapeHTMLTags(username);
  
      String password = ParamUtils.getParameter(request, "password");
      String url = ParamUtils.getParameter(request, "url");
  
negative.code:     Map<String, String> errors = new HashMap<String, String>();
  
      if (ParamUtils.getBooleanParameter(request, "login")) {
          String loginUsername = username;
          if (loginUsername != null) {
              loginUsername = JID.escapeNode(loginUsername);
          }
          try {
              if (LoginLimitManager.getInstance().hasHitConnectionLimit(loginUsername, request.getRemoteAddr())) {
                  throw new UnauthorizedException("User '" + loginUsername +"' or address '" + request.getRemoteAddr() + "' has his login attempt limit.");
              }
              if (!AdminManager.getInstance().isUserAdmin(loginUsername, true)) {
                  throw new UnauthorizedException("User '" + loginUsername + "' not allowed to login.");
              }
              if (secret != null && nodeID != null) {
                  if (StringUtils.hash(AdminConsolePlugin.secret).equals(secret) && ClusterManager.isClusterMember(Base64.decode(nodeID, Base64.URL_SAFE))) {
                      authToken = new AuthToken(loginUsername);
                  }
                  else if ("clearspace".equals(nodeID) && ClearspaceManager.isEnabled()) {
                      ClearspaceManager csmanager = ClearspaceManager.getInstance();
                      String sharedSecret = csmanager.getSharedSecret();
                      if (nonce == null || sharedSecret == null || !csmanager.isValidNonce(nonce) ||
                              !StringUtils.hash(loginUsername + ":" + sharedSecret + ":" + nonce).equals(secret)) {
                          throw new UnauthorizedException("SSO failed. Invalid secret was provided");
                      }
                      authToken = new AuthToken(loginUsername);
                  }
                  else {
                      throw new UnauthorizedException("SSO failed. Invalid secret or node ID was provided");
                  }
              }
              else {
                  authToken = AuthFactory.authenticate(loginUsername, password);
              }
              LoginLimitManager.getInstance().recordSuccessfulAttempt(loginUsername, request.getRemoteAddr());
              session.setAttribute("jive.admin.authToken", authToken);
              response.sendRedirect(go(url));
              return;
  