Provide a message that passwd/pvtkey is not transmitted to the nutty server, rather the ssh auth happens between browser and ssh-server directly.
Make SSH-host default value "localhost"