Prevent to send plaintext password to browser

Fix for JENKINS-23165 and pull #157
Prevent to send plain HTTP password to browser
Merge pull request #158 from rinrinne/pw-on-browser

Prevent to send plaintext password to browser