yiisoft/yii — pull request #3107 by Abbas-Hashemian (2013-12-12 16:21:11+00:00)
Title: It's better to prevent password field viewstate

Mostly password fields don't have viewstate in ASP.Net or web frameworks. Because either in HTTP or HTTPS postback communications the posted password will be visible in the source code of the page has been responded back to the client.
Affects in the CActiveForm and the ::activePasswordField.