Whether it works or not (I have no current means to test it either) parrt of the issue is that it needs to work using only what is available in NetBSD release - so starting with #!/usr/pkg/bin/lua5.2 is not a good sign!
Beyond that: -- assumes the fields are called 'username' and 'password' they probably aren't, they can be anything. You really need to parse the form. There are also often "hidden input" fields, where the form provides the value to be sent back (which a normal browser user never sees.) kre