Function old_input_of 

pub fn old_input_of(request: &mut Request) -> Json

The submitted fields worth keeping, as a JSON object.

Anything whose name looks like a secret is dropped. The check is on the name rather than the value because there is nothing about a password that makes it recognisable — and the cost of guessing wrong in this direction is only an empty field, while guessing wrong in the other puts a password in the HTML.