[andrewflnr]

That would be meaningful if we were talking about some optional UX feature, but this is security. Does having a non-representative browser config mean we don't deserve security? I think not. Security has to work without JS.

[spdustin]

Why wouldn't it just <noscript> an input field to enter the token