added note on hidden fields, and included password type in input