login: use password_field instead of text_field with type password