Yarg... With the credentials piece, the final solution was already in my hand. A boneheaded developer at the other end included a hidden form element with value="PLACEHOLDER_NOTUSEDANYMORE" and decided that this was a required field, not excepting the form without it.