Minor doc fixes.
Add note on password management.
Look for login fields only if there's a password field.