warehouse: Remove <form> on WebAuth provision

[woodruffw]

<form> was introduced in #6524, but was causing some weird routing when submitted via the return key rather than a direct button press (probably because <form> defaults to GET). It's also unfortunately still nonfunctional with method="POST", since we still need to perform the relevant WebAuthn operations in JavaScript.

[woodruffw]

cc @di @nlhkabu

[di]

Is it possible to use onsubmit here instead?

[woodruffw]

Is it possible to use onsubmit here instead?

I was under the impression that the CSP policy would block it, based on this script-src definition:

                "script-src": [
                    SELF,
                    "www.googletagmanager.com",
                    "www.google-analytics.com",
                    "*.fastly-insights.com",
                    "https://cdn.ravenjs.com",
                ],

But I'll give it a try locally!

[woodruffw]

Yep, I get a CSP error when activating the form via onsubmit.

[nlhkabu]

Why do we need the new JS here? Can we just revert adding the <form> tag for now?

[woodruffw]

Why do we need the new JS here?

The JS handles the case where the user hits the return key on the label input. With <form> that caused an (incorrect) GET to the endpoint; with the JS it submits the POST correctly.

I could remove it and limit this PR to just the revert, but I think the non-<form> behavior without it is a little unintuitive (but also not strictly broken).

[nlhkabu]

ok, thanks. I'll defer to @di for reviewing the JS. Once this is merged, I will reopen #6472