[spdustin]

You and I both. Remember, however, that you and I are not a representative sample of the general population of web users.

[andrewflnr]

That would be meaningful if we were talking about some optional UX feature, but this is security. Does having a non-representative browser config mean we don't deserve security? I think not. Security has to work without JS.

[spdustin]

Why wouldn't it just <noscript> an input field to enter the token