Fix password managers interaction

README.md

@@ -7,7 +7,7 @@ Built for sharing large binaries with friends so that I don't have to manually m
 
 * One static Go binary, standard library only.
 * Anyone who can reach the page may upload, within a size cap and a lifetime.
-* Named tokens raise those limits, unlock custom URLs, and can grant admin.
+* Named tokens raise those limits, unlock vanity names, and can grant admin.
 
 ## Quickstart
 

web/templates/index.html

@@ -32,7 +32,12 @@
     </p>
     <label class="field">
       <span>Token</span>
-      <input type="password" name="token" autocomplete="new-password">
+      <!-- Plain text on purpose: this is pasted once, behind a collapsed
+           panel, and a masked field only hides the typo. Keeping it out of
+           the password family also stops the browser treating this form as a
+           login and hunting for a username to fill in above. -->
+      <input type="text" name="token" autocomplete="off"
+             spellcheck="false" autocapitalize="off">
     </label>
   </details>
 

web/templates/info.html

@@ -40,7 +40,10 @@
         <input type="hidden" name="from" value="info">
         <label class="field">
           <span>Delete token</span>
-          <input type="password" name="token" autocomplete="off" required>
+          <!-- Plain text, like the upload form's: a delete token is pasted
+               once and a mask would only hide a mistake in it. -->
+          <input type="text" name="token" autocomplete="off" required
+                 spellcheck="false" autocapitalize="off">
         </label>
         <button type="submit" class="danger"
                 data-confirm="Delete {{.Meta.Filename}}? This cannot be undone.">Delete this file</button>

web/templates/login.html

@@ -17,7 +17,7 @@
 <section class="card">
   <h1>Log in</h1>
   <p class="hint">
-    A token raises your size and lifetime limits and lets you choose custom
+    A token raises your size and lifetime limits and lets you choose vanity
     names. Logging in keeps it for this browser, so you do not have to paste it
     for every upload. Without one you can still upload anonymously.
   </p>