Trying to track down an issue recently I noticed that /login/index.php is using "magic numbers" for the $errorcode variable in some places, rather than the defined AUTH_LOGIN_* constants. This makes it more difficult to read and understand the code, and to track down issues, so it would be a good idea to replace them.