Set Content-type on AJAX login key request to application/json to hopefully block ad injection
.mceItemFlash {
border: 1px dotted #cc0000;
background-image: url('../images/flash.gif');
background-position: center;
background-repeat: no-repeat;
background-color: #ffffcc;
}