Login and Registration: Simplify the test for `wp_signon()` added in [46640].

Make sure it actually tests the change in behavior, previously it passed both before and after the patch.

Add `wp_unslash()` to the last remaining instance of `$_POST['user_login']` that didn't have it.

See #38744.
Built from https://develop.svn.wordpress.org/trunk@46650


git-svn-id: https://core.svn.wordpress.org/trunk@46450 1a063a9b-81f0-0310-95a4-ce76da25c4cd