Some users are still having problems with the pop-up login. I think they are actually getting 403s because of the CSRF protection. So I have modified the base template to always have a javascript variable called csrf_token available when they aren't logged in. The ajax_login.js script was then modified to send this value with the ajax post. Fingers crossed.

#frmbody {
	padding: 10px;
	background-color: #FFF;
	border: 1px solid #CCC;
}

.frmRow {
	margin-bottom: 10px;
}

#templatesrc {
	border: none;
	width: 320px;
	height: 240px;
}

.title {
	padding-bottom: 5px;
}

.mceActionPanel {
	padding-top: 5px;
}