<html>
  <head>
    <noscript>
      <meta http-equiv="Refresh" content="0;URL=?no_js=1&next={{ next }}" />
    </noscript>
  </head>
  <body>
    <form method="post" id="not-a-bot-form">
      {% csrf_token %}
      <input type="hidden" name="not_a_bot" value="yes" />
      <input type="hidden" name="next" value="{{ next }}" id="next" />
    </form>
    <script>
      {# set form next value from JS to include url fragment, which we can't see on the server side #}
      document.getElementById('next').value