clarify that password is shown only upon submission