So far, I have at least did a second part of the fix: the input is now type=password:
http://github.com/aerogear/aerogear-unifiedpush-server/commit/e78835aae