[Cyranix]

Would it be acceptable to set the form's submit button to disabled in the HTML, attaching the custom event handler and enabling the submit button in a document-final script? Seems like you still get reasonable behavior in the low-bandwidth environment -- maybe even better, since the user can now access the other elements of the form while the script is being loaded and run.

[bluesmoon]

That's an accessibility issue for users with JavaScript disabled (or where JavaScript fails to load).

On the other hand, it's also the recommended method to protect your users from a click-jacking attack across all browsers (read those that don't support CORS).