I'm just wondering how someone could login to an account without being exposed to a password. The password has to go into a web page field to submit a login request.