hide the password from update form

admin/user.php (edit)
user.php (profile)

— preventing password hash from showing in inspect element.
[authorisation bypass] admin page restriction

prevent non-admin user to access the admin page.
Re-using function htmlSpecialChar