This currently only works because CookieCrumbler reacts on *all* urls which
contain the magic login & password fields. But the POST request body lacks
any value from submit fields, which bypasses the "logged-in" scripts, which
is harmless with current code but lack realism.