OK, I hate to disagree with you Lynne, but the OP says a "custom CMS" and this is the vb3 section, so that won't work for several reasons.
Edit: Well OK, unless it actually is using templates, in which case it's only the one reason....
But FWIW I did try out the code from the OP in a static html file and the problem seems to be that the CSRF Protection stuff checks for a security token unless the "do" field is set to "login".