[whatwg] Re: autocomplete=off

[Malcolm Rowe]

Jim Ley writes: 

> Which is why it makes sense to me for it to be a SHOULD.  it's what
> should's for after all, you can further constrain it within the spec
> with the default behaviour MUST be, users need to be made aware etc.

Ok, perhaps after the text: 

"The on value means the UA is allowed to store the value entered by the user 
so that if the user returns to the page, the UA can pre-fill the form. The 
off value means that the UA must not remember that field's value." 

We could add a paragraph: 

"A UA _may_ allow the user to disable support for this attribute. Support 
_must_ be enabled by default, and the ability to disable support _should 
not_ be trivially accessible, as there are significant security implications 
for the user if support for this attribute is disabled." 

How about something like that? It more accurately reflects existing 
practice, and allows us to mark the current implementations as compliant. 

Regards,
Malcolm