The concept of putting <script src=> on my login page skeevs me out more than a little bit. This is a major security hole that won't be patched until there is native support in the browser.