enrolment key should not be named as a password field, it should be named as enrolment key and the html field should be something else, maybe dynamically generated so it doesn't keep prefiling the field with ones personal password
autocomplete="off"
Maybe
Albert