"`, on the
// reasoning that echoing the request back would preserve the `next`
// parameter across the POST. It does preserve it, and it also produces
// `action="/login.php/login.php"` on every GET of this page — so the login
// form submitted to a URL that does not exist and the panel could not be
// signed into through the UI at all. Measured, not reasoned: the rendered
// markup was fetched from the running server and the POST target returned
// HTTP 404.
//
// It survived 65 passing end-to-end checks because every one of them POSTed
// to a URL the test had constructed itself. Nothing had ever asked the
// browser to press the button, so nothing noticed the button was broken.
// That is the failure mode this comment exists to prevent: a test that
// bypasses the thing it is testing.
//
// `next` is carried by the hidden field below instead, which is where a POST
// body belongs. It is validated by the same open-redirect guard either way.
?>