Hmf. I wanted to cobble together a little thing that could update the plan from a shell. Using curl, I can't get anything other than a 500 reply when posting to /login, even after storing and sending the cookie from an initial get request, retrieving the csrf token for the form, and matching all the headers from a normal browser session.

If anybody manages to get a working login with curl, I'd love to see the magic incantation you used.