When the username and password fields are unset, they return a userdata object with a value of nil, rather than a string object. - what is a userdata object? Should it not just return an empty string?
Also, as some others have already pointed out, the password field is not hidden with **** with a show button (like in most password fields) but can be seen in cleartext.