The process described there conforms to how things behaved during the old "do_login" days. We should update it to reflect the current state of affairs. Might also want to mention the differences between the native client and the html client.