What would you recommend more specifically? In particular, whatever LastPass is doing seems likely to be fragile unless there's consensus about how to identify

What would you recommend more specifically? In particular, whatever LastPass is doing seems likely to be fragile unless there's consensus about how to identify a form as one that accepts tokens (usually a username/password combination) to authenticate an existing user, or similarly set parameters for a new user, or change authentication tokens, or… In the Unix world, there are various extant mechanisms for this around: PAM, LDAP, &c. However, I haven't detected any published rough consensus for the Web; searching for terms like “design login form common field names username password” doesn't turn up anything obvious. The only strong heuristic that I can think of is detecting form fields of password type, and then distinguishing the use cases temporally based on whether you already have tokens cached.