Great, it's working now.
I ran into another strange bug. If you're already logged into WeChall with an active session that's been open for a while, then click the "Submit token" button on OTW, there's a good chance you'll get logged out of WeChall.
Maybe WeChall has some kind of protection against this type of cross-site POST request?