I think so, but I'll tell you tomorrow when I'm not on my watch

The solution is:

• add an api to get auth that doesn’t send the token in a header (mostly copy-pasting from the current auth api)

• add a listener to the form to intercept the default behavior (posting to the original api) and instead post to the new api and then save the returned cookie in the browser using document.cookie (this works, I’ve tested)

• But don’t change the form’s default behavior, so it’ll still work when javascript is disabled

@jeffalo