Is Plone 5 still using the old /login & /login_form stuff or has it been replaced with something, such as plone.login (or will it be)? Any chance such new developments could be used on Plone4.x?
Plone 5 still uses the scripts from Plones early stoneage you mentioned.
plone.login is a good start, but I miss user stories and concepts for such a complex topic. plone.login is based on 3 mock-screens. A new login system needs to be both: bulletproof secure, supporting modern login concepts and a superior UI.