Fix password managers interaction

web/templates/index.html

@@ -32,7 +32,12 @@
     </p>
     <label class="field">
       <span>Token</span>
-      <input type="password" name="token" autocomplete="new-password">
+      <!-- Plain text on purpose: this is pasted once, behind a collapsed
+           panel, and a masked field only hides the typo. Keeping it out of
+           the password family also stops the browser treating this form as a
+           login and hunting for a username to fill in above. -->
+      <input type="text" name="token" autocomplete="off"
+             spellcheck="false" autocapitalize="off">
     </label>
   </details>
 

web/templates/info.html

@@ -40,7 +40,10 @@
         <input type="hidden" name="from" value="info">
         <label class="field">
           <span>Delete token</span>
-          <input type="password" name="token" autocomplete="off" required>
+          <!-- Plain text, like the upload form's: a delete token is pasted
+               once and a mask would only hide a mistake in it. -->
+          <input type="text" name="token" autocomplete="off" required
+                 spellcheck="false" autocapitalize="off">
         </label>
         <button type="submit" class="danger"
                 data-confirm="Delete {{.Meta.Filename}}? This cannot be undone.">Delete this file</button>

web/templates/login.html

@@ -17,7 +17,7 @@
 <section class="card">
   <h1>Log in</h1>
   <p class="hint">
-    A token raises your size and lifetime limits and lets you choose custom
+    A token raises your size and lifetime limits and lets you choose vanity
     names. Logging in keeps it for this browser, so you do not have to paste it
     for every upload. Without one you can still upload anonymously.
   </p>