new thread/new reply has a hidden password field in the event someone wants to use an alternate account. this feature can probably be stripped, or if nothing else make the password field only added in the event that someone chooses to do so.

right now it causes autocomplete to fill it in, which makes auth fail (no username specified) and gives an unhelpful "unauthorized to post" message