value="${password}"/>
I thought mine just said value="${password}" too, but nope, its there in all its unencrypted glory.