A popular requirement these days is to have some sort of
if (document.logonForm.accept.checked == true)
document.logonForm.uidPasswordLogon.disabled = false;
document.logonForm.uidPasswordLogon.disabled = true;
With this in place, whenever a user types his/her user id and password and clicks on the checkbox, the Log On Button will be enabled to go ahead. If he/she de selects it the Log On Button will be disabled. In any scenario where the Authentication fails due to wrong User Id or Password submitted, the page anyway re loads and so the Log On Button is disabled again.