JavaScript is required to sign in — the origin requires a request-body hash that a plain form post cannot send.