Credential dialog spoofing with JavaScript and HTML on the web