Client must provide a proof-of-work. There is no standard for that, so the only way is to implement the client-side code in javascript.

It would be great if there was a standard for that so that all kinds of clients knew how to provide a proof of work, e.g. like this:

  WWW-Authenticate: Proof-Of-Work difficulty=5 challenge=XYZ
  Authorization: Proof-Of-Work abc

Where sha256(abcXYZ) would have to start with at least 5 zeros.