This is wrong: we need a field with type = password so that the password is not shown in clear text.