To begin with - login url is relative, so it should no be checked with absolute regex.

Username as salt
Slow hashing
Long result

POST
Ensure referrer
Send x-Requested-With: XmlHttpRequest
Ensure Synchronizer Token
Ensure elapsed time
Send hashcash if was requested
Send captcha if was requested

executeLogin(loginUrl, serverInstructions, hashcash,

The response may be a proof of work request, or the actual login.

(20 char or 6+ with special characters, digits, cases)

When importing the library (in signum-demo), I get this error in the console:

Uncaught SyntaxError: Identifier 'PasswordTolerance' has already been declared

Normalization for passphrase (=default 20+):

Lower case
Trim
Replace all whitespace with single dash
Remove all symbols (punctuation, apostrophe)
Replace digits with single 0

function normalizePassphrase(passphrase, minimalLength=20)

Uncaught ReferenceError: exports is not defined