[readme] add note about behavior with password inputs