Are you sure your javascript ajax section is running? Are you sure it is running when you want it to run? And most importantly is it sending the correct parameters to the CGI script (note that you do not validate input data in your CGI script - that's a big problem) ? Is it perhaps running after you hit submit? Doesn't action="cgi-bin/login.cgi" in the form means that when you hit submit the CGI script is called? If so, then when does the ajax call is made?

Also important is that your ajax call xmlhttp.open("GET", "cgi-bin/login.cgi", true); does not send any parameters. I don't think it sends the form or the user email at all!

btw, unless you state in some CSS otherwise, <div class="error-msg" is showing by default, no?