I have noticed that loginlink() creates a lot of DC ("duplicate content") (for security_type page)[1]. IMO it is conceptually flawed the way it is now, where the login link is created by appending &login to the current page URL. Requesting the login URL sets $su to the URL of the page and $s to its numeric index. Then the plugins etc. are processed, and only shortly before the script includes the template function loginforms() is called, which writes the login form to $o and sets $s to -1. IOW: during the loading of the plugins $su as well as $s indicate that a certain page will be displayed, but that does not happen.
That is potentially worse than the DC.ISTM the clean solution would be to use "login" as first query parameter and append a second parameter, which specifies the desired page (say, ?login&selected=...). This would set $s quite early (before the plugins are loaded) to -1 (assuming there is no page with the h1 heading "login"), and the selected parameter could be easily trimmed from the <DEL>canonical</DEL> link, which would give the desired canonical link.
I suppose that this change could be easily implemented, and won't result in considerable incompatibilities with existing extensions, but I'm not sure, if it would be better to postpone it to CMSimple_XH 1.6 (if at all). Closer examination is pending.
[1] ge_canonical doesn't really help here, as the complete login link is set as canonical link. My own solution (see http://3-magi.net/?Hello&login is not better as it allows (currently it's configured this way) to suppress the &login from the canonical link, but that results in canonical links which have different content, what is worse.
Christoph
