diff --git a/nodejs/public/lib/js/app-base.js b/nodejs/public/lib/js/app-base.js
index 2b323a3..d5fff48 100644
--- a/nodejs/public/lib/js/app-base.js
+++ b/nodejs/public/lib/js/app-base.js
@@ -129,7 +129,14 @@ app.api = (function(app){
 		return body('PUT', url, data, callback);
 	}
 
-	function remove(url, callback){
+	// Called both as (url, callback) and — from formAJAX, which always passes
+	// the serialized form as the second argument — as (url, data, callback).
+	// No request body is sent either way.
+	function remove(url, data, callback){
+		if(typeof data === 'function'){
+			callback = data;
+			data = undefined;
+		}
 		if(typeof callback !== 'function'){
 			return new Promise(function(resolve, reject){
 				$.ajax({
diff --git a/nodejs/views/login.ejs b/nodejs/views/login.ejs
index e774373..705eced 100755
--- a/nodejs/views/login.ejs
+++ b/nodejs/views/login.ejs
@@ -4,14 +4,18 @@
 	// If we arrived from the OIDC callback with a token in the URL fragment,
 	// store it and forward on before doing anything else.
 	if(!app.auth.consumeTokenFragment()){
-		app.auth.isLoggedIn(function(error, isLoggedIn){
-			if(isLoggedIn){
-				app.auth.logInRedirect();
-			}else{
-				// Reveal the login card once we know the user is not logged in.
-				document.getElementById('login-card-row').style.display = '';
-			}
-		})
+		// The reveal below touches an element further down this page, so wait
+		// for the DOM — isLoggedIn can answer before the parser gets there.
+		$(document).ready(function(){
+			app.auth.isLoggedIn(function(error, isLoggedIn){
+				if(isLoggedIn){
+					app.auth.logInRedirect();
+				}else{
+					// Reveal the login card once we know the user is not logged in.
+					document.getElementById('login-card-row').style.display = '';
+				}
+			});
+		});
 	}
 
 </script>