Google provides JS to make it easy and reduce the server side work, but it is optional and I would not use it. Re your point of interacting with conglomerate-tainted users, seems like that's a lost cause. People are going to be storing their passwords in conglomerate-provided browsers anyway.