Test native login forms when enforcing Origin checks
When a server rejects cross-origin POSTs by validating the Origin header, include a real native HTML form submission in acceptance tests. An API test that supplies Origin explicitly can pass while the browser form is rejected: a strict no-referrer response policy can yield an opa…