Path to secure.login.js is incorrect, prevents login

In lib/xfw_private.class.js line 447:

echo '<script src="'.get_bloginfo('url').'/'.XFW_PATH.'/js/secure.login.js" type="text/javascript"></script>';

This expands to something like https://www.example.com//home/username/public_html/wp-content/plugins/…

It should be:

echo '<script src="'.XFW_URL.'/js/secure.login.js" type="text/javascript"></script>';