AFAICT the better ones (including Google's existing flow) have the password input present in the document, but hidden, and unhide when they want to ask for it.

AFAICT the better ones (including Google's existing flow) have the password input present in the document, but hidden, and unhide when they want to ask for it. That way a manager looking at the DOM can pre-fill (or be ready to fill) the password. Splitting across two documents seems monstrous and probably insecure?