add a show/hide password button to the login form. It should show up only if
a strict CSP policy.
Add to all bundled templates. Consider adding to the user.item.html form as well
to allow user to see their primary and secondary password entries.
Ugh I missed that bootstrap 4 is required by the show/hide github repo.
However a cleanroom or other implementation is welcome. See also:
* don’t allow users to submit text inputs containing passwords
so if the password is visible when the submit button is hit, change it
back to a password field. Otherwise autocomplete can store the
password. This is bad as the password should only be in the password