... If you have arbitrary memory access on the browser's machine, your site's password is screwed no matter what you do, and that is very much not the most inte

... If you have arbitrary memory access on the browser's machine, your site's password is screwed no matter what you do, and that is very much not the most interesting thing to be done with that access. Your session management / CSRF token will take care of replay attacks without you having to worry about integrating that into your login page. If your sessions aren't secure against replays they can be replayed after the login anyhow.