diff --git a/src/Routes/RouteStaticResources.c b/src/Routes/RouteStaticResources.c
index b04450d..4bc1072 100644
--- a/src/Routes/RouteStaticResources.c
+++ b/src/Routes/RouteStaticResources.c
@@ -67,7 +67,11 @@ ROUTE_IMPL(RouteStaticResources, path, argp)
                    "  var xhr = new XMLHttpRequest();"
                    "  xhr.open(meth, url);"
          "  xhr.setRequestHeader('Content-Type', 'application/json');"
-                   "  xhr.onreadystatechange = () => cb(xhr);"
+                   "  xhr.onreadystatechange = () => {"
+                   "    if (xhr.readyState == 4) {"
+                   "      cb(xhr);"
+                   "    }"
+                   "  };"
                    "  xhr.send(JSON.stringify(json));"
                    "}"
                    "function onFormSubmit(frm, cb) {"
diff --git a/src/Routes/RouteUiaFallback.c b/src/Routes/RouteUiaFallback.c
index d8b90c8..878db54 100644
--- a/src/Routes/RouteUiaFallback.c
+++ b/src/Routes/RouteUiaFallback.c
@@ -67,19 +67,14 @@ ROUTE_IMPL(RouteUiaFallback, path, argp)
             return MatrixErrorCreate(M_NOT_JSON);
         }
 
-        Log(LOG_DEBUG, "Building flows...");
         flow = ArrayCreate();
         flows = ArrayCreate();
         ArrayAdd(flow, UiaStageBuild(authType, NULL));
         ArrayAdd(flows, flow);
-        Log(LOG_DEBUG, "about to UiaComplete()...");
         uiaResult = UiaComplete(flows, args->context,
             args->matrixArgs->db, request, &response, config);
-        Log(LOG_DEBUG, "Freeing flows...");
         UiaFlowsFree(flows);
 
-        Log(LOG_DEBUG, "Completed UIA.");
-
         if (uiaResult < 0)
         {
             HttpResponseStatus(args->context, HTTP_INTERNAL_SERVER_ERROR);
@@ -123,12 +118,26 @@ ROUTE_IMPL(RouteUiaFallback, path, argp)
                    "<input type=\"submit\" value=\"Authenticate\">");
         HtmlEndForm(stream);
         HtmlBeginJs(stream);
-        /* TODO */
-        StreamPuts(stream,
+        StreamPrintf(stream,
                    "function buildRequest() {"
-                   "  setFormError('Not implemented yet.');"
-                   "  return false;"
-                   "}");
+                   "  let user = document.getElementById('user').value;"
+                   "  let pass = document.getElementById('password').value;"
+                   "  if (!user || !pass) {"
+                   "    setFormError('Please specify a username and password.');"
+                   "    return false;"
+                   "  }"
+                   "  return {"
+                   "    auth: {"
+                   "      type: '%s',"
+                   "      identifier: {"
+                   "        type: 'm.id.user',"
+                   "        user: user"
+                   "      },"
+                   "      password: pass,"
+                   "      session: '%s'"
+                   "    }"
+                   "  };"
+                   "}", authType, sessionId);
         HtmlEndJs(stream);
     }
     else if (strcmp(authType, "m.login.registration_token") == 0)
@@ -171,9 +180,11 @@ ROUTE_IMPL(RouteUiaFallback, path, argp)
     }
 
     HtmlBeginJs(stream);
-    StreamPuts(stream,
+    StreamPrintf(stream,
                "function processResponse(xhr) {"
-               "  if (xhr.status == 200) {"
+               "  let r = JSON.parse(xhr.responseText);"
+               "  console.log(r);"
+               "  if (xhr.status == 200 || r.completed.includes('%s')) {"
                "    if (window.onAuthDone) {"
                "      window.onAuthDone();"
         "    } else if (window.opener && window.opener.postMessage) {"
@@ -181,12 +192,12 @@ ROUTE_IMPL(RouteUiaFallback, path, argp)
                "    } else {"
                "      setFormError('Client error.');"
                "    }"
+               "  } else if (r.session != '%s') {"
+               "    setFormError('Invalid session.');"
                "  } else {"
-               "    console.log(xhr.responseText);"
-               "    let r = JSON.parse(xhr.responseText);"
-               "    setFormError(`${r.errcode}: ${r.error}`);"
+               "    setFormError('Invalid credentials.');"
                "  }"
-               "}");
+               "}", authType, sessionId);
 
     StreamPuts(stream,
                "onFormSubmit('auth-form', (frm) => {"
diff --git a/tools/env.sh b/tools/env.sh
index 51948b2..9405f53 100644
--- a/tools/env.sh
+++ b/tools/env.sh
@@ -33,3 +33,4 @@ fi
 
 export PATH="$(pwd)/tools/bin:$(pwd)/build/tools:$PATH"
 export MANPATH="$(pwd)/man:$MANPATH"
+export MALLOC_OPTIONS="CFGJS"