Custom form-based HTTP authentication