- initial setup form: password field should be type=password
Are you sure of that? It’s not uncommon to use a plain text field for password when first setting up an account. This is helpful to be sure you are 100% positive of the password the first time you configure the account. I’m not personally too concerned with people completing their one-time ContentBox install from a public library with people reading over their shoulder.