> Regulatory compliance. I've worked on applications that had to go to great lengths to get the target browser platform to not do something like auto-complete authentication credentials.

If I had a penny for every time I've heard this excuse for really terrible unsafe practices just to find out that the developer deliberately misinterprets it to make its job easier... it be rather rich now.