i think ossipena is on the right path. a password input area should always mask the password and it will not show up in autocomplete.