Password reset fields set to type text

[richardhallett]

The input fields for the password reset are set to input type="text" this has the behaviour of letting the browser try to remember this as plain text as opposed to only just for passwords.

This is potentially bad security as it could end up exposing the users passwords in other prompts unintentionally.

Suggestion is to set input type to "password", alternatively we could expand this to be a toggled switch to show the password visibility and set the text field to have "autocomplete=off" to attempt to avoid any accidental browser remembering.

[mfenner]

+1 for type="password".

[richardhallett]

Made the change to type="password", Deployed to test, will go to production in next release.