I think a better solution would be something like implementing Digest
Authentication (RFC 2069, but replacing MD5 with something like AES-256
and allow it to be upgradable) in the browser. The password field value
would then be replaced with the value from the DA call and no secrets
would be leaked. This solution would get way faster adoption.