I've got absolutely no idea how this works — as I understand HTTP, this shouldn't happen; which probably explains why it doesn't work with Mozilla. Could you show us some (password/username-sanitized) code so we can play with it ourselves?

I gleaned some of that too, by trying to log in with Lynx. It kept giving me error messages, but you can actually get in with Lynx, because it will say something like "POST doesn't work, want to continue with GET instead?"

I haven't got my code here to show you but essentially what I'd do is get the page with LWP, grab the hidden field values (the "challenges") then construct a form submission to the form's "action" by shoving all the key-value pairs into a string. Something like (pseudocode)

$login = new HTTP::Request($action);
$login->type(www-encoded form);
$login->content('a=1&b=2&c=3');
$useragent->do($login)
[download]

and I presume that's what WWW::Mechanize was doing too.