Password form field uses type="text"

[Miserlou]

This is an ugly one. :(

When using the browser based views, the HTML form uses type="text" instead of type="password" for the password field. If you're pair programming or doing a demo.. well, you can imagine. This is certainly unexpected behavior and in my opinion a security problem! Never, ever show passwords in forms in clear text without alerting the user that it's about to happen. If you see a password box, you immediately assume it will be safe!

Also, the fields are the wrong way round. Normally web forms are

Username:
Password:

not

Password:
Username:

That's weird.