Possible security vulnerability in cosign_form_alter (login block)

Security scanners have reported a XSS vulnerability in the login link when html tags are included in the page url.

Browser request:
example.com/?<script>badscript</script>
Resulting login block link:
<a href="https://example.com/?<script>badscript</script>">Login</a>

The attached patch decodes the url, then passes it through Drupal's filter_xss function to remove any html tags present in the url. This has resolved the issue with our scanners.

As a side note, this may be more appropriate to patch in request_uri() since that function is failing to filter out malicious code.