Verifying the password flow needs a login to actually happen, and
driving one by hand means a human at the keyboard. ?auto=1 fills the
fields and logs in on load, with user, pass, succeed, rmdom and push as
query parameters so each trigger and the failure case can be exercised
without touching a real account.
Values are written with the native setter followed by a real 'input'
event, which is what a keystroke produces and what inject.js listens
for. Worth being clear about the limit: this proves the trigger fires
for a field that reached its value the way a browser reports it, not
that physical typing works.
Vincent