For passwords one may also trigger <form> submit (from js), and then prevent submit event.
Also, I think it's better to change form.Panel renderTpl and replace body <div>, not the container one, with <form>.