Make the certificate field a password field so that it can't be read
The security realm needs a @DataBoundConstructor to be initialized