The notepad interface is withheld until the server confirms a valid session.
The secure login flow uses JavaScript to exchange a CSRF-protected PIN with the server.