#gRegorLoveNo, but I had already added that <link> on my site so I probably didn't think through that fully at the time. The login form posts directly to https://indieauth.com/auth, the plugin verifies the code with the same URL, then uses the "me" param to find the PW user.