When you deploy this on the network, unless you are doing intentional testing, any form submission is a red flag. This means that someone is making an attempt to log in to your fake server. Since there is no legitimate purpose for it, only an attacker would have any reason to attempt to gain access. There will be no real authentication or authorization, just a facade to make the attacker think they are attempting to log in. The Go HTTP package does support HTTP 2 by default in Go 1.6+. Read more about the net/http package at https://golang.org/pkg/net/http/.
The following program will act as a web server with a login page, that just logs form submissions to standard output. You can run this server and then try ...
