> 1. The JS could be loaded from a CDN, not the same service that has access to the password. You may have absolutely no control over the JS on the page.

You have full control over it, as long as you don't embed any third-party maps or crap like ads.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...