Right, I would create the form. Ideally, my own code would show the form, then upon submission via Ajax (or page refresh), it would log the user in.
I wanted to leave the code hijacking to a last resort but it might have to do.
Is there anything you can tell me about the wp function wp_signon?