If someone enters their credentials in the sign-in page preview
just to try it out and clicks the Sign in button the credentials
will be shown in the URL because the form is submitted with GET
action. This MR changes the button type so the form simply can't be
submitted.

Changelog: security