field() now uses password type by default when first 8 chars are 'password'