Javascript just makes the attack faster, but it can be accomplished with raw html. Cookies are required though; it's what you are after when using this attack.