Also remember that many browsers will autofill this field, including the password, if someone just types the first 2 characters of the username. And malicious w

Also remember that many browsers will autofill this field, including the password, if someone just types the first 2 characters of the username. And malicious websites can take advantage of that fact to scrape U/P pairs with half the work. Bad idea.