visually obscure password input

Encourage best practices by default, yo!

(Released under APACHE2; no attribution required)