when resetting the password, it shows in plain text on the second field being exposed, it should be also hidden with ******