They???ll probably tell you its for security reasons, but regardless of whether the username is a correct one or not (in the database) ??? it should still persist in the UI. A token can be used to determine if the post request is coming from the correct domain to prevent a dictionary attack against the login form.