Currently at our demo we have autocomplete enabled by default. For example on:
http://controller-aerogear.rhcloud.com/aerogear-controller-demo/login
http://controller-aerogear.rhcloud.com/aerogear-controller-demo/register
If an attacker access the browser cache, the information could easily obtained in cleartext.