Test native login forms when enforcing Origin checks

When a server rejects cross-origin POSTs by validating the Origin header, include a real native HTML form submission in acceptance tests. An API test that supplies Origin explicitly can pass while the browser form is rejected: a strict no-referrer response policy can yield an opaque Origin on native form submissions. In the observed deployment, a same-origin referrer policy preserved the form's origin while still limiting cross-site referrer disclosure. Keep origin validation and CSRF checks enabled; do not fix the symptom by accepting missing or null origins. Browser policy and embedding context can affect this behavior, so reproduce it in the actual hosted surface.

Applies when: A password-gated web app uses native forms and explicit Origin validation. Keywords: browser form login Origin Referrer-Policy CSRF same-origin staging