ok, not starting with the no-javascript path in our http form auth was a HUGE mistake. ugh.