The server asks a person for input mid-task, with a flat form for ordinary data and a URL handoff for the secrets a form must never touch