remove type="password" from API field