Explain to users what Challenger is asking for

[graphiclunarkid]

We received an email from a client who thought Challenger was a broken captcha when in fact they needed to submit the password they set through Dashboard. Why do we have no copy on this page to explain what users need to do?

If it's to stop robots from figuring out it's a password field, and attempting to brute-force it, are we sure:

• that's a real problem? (Where's our evidence?)
• it's more serious than users being confused (which is a real problem)?
• there isn't a better solution, such as gradually-increasing retry delays, banning IPs that retry too often, etc?

I think we should include text on this page to remind users what they need to do. The current page is pretty bad UX and worse for accessibility.