As for #1, there's a good reason why login forms <i>shouldn't</i> persist form state: it leaks information. Showing the successful username leaks information that that username exists. It also is a subtle, possibly incorrect, hint that the user typed <i>their</i> username correctly. It is just as likely that the user typed their username wrong, and as the number of users go up, the chance of a one or two character difference between usernames is increased. If the username field is filled in, users might realize that they entered it wrong and won't fix it, but rather just retype the password, the wrong password for the account given.