This is neat, worked for me (I'm signed in to two Google accounts, both were detected).

This is really neither here nor there, but your email input field isn't escaped, so JS can be injected into the email field e.g. <script>alert('Hi Tom!')</script>.

I enjoy the irony of a security-minded page having this issue, even though there's no good reason for you to bother escaping the field :)