Your Username/Password is wrong.
<form action="/User.html" method="POST">
username: <input type="text" name="username"><br />
password: <input type="password" name="password"><br />
<input type="hidden" name="returnto", value="#[returnto]#"><br />
<input type="submit" value="login">
</form>