Ref T13202. See https://discourse.phabricator-community.org/t/2fa-input-box-isnt-hinted-as-a-password-so-browsers-suggest-auto-fills/1959.
If browsers are autofilling this, I think browser behavior here is bad, but behavior is probably better on the balance if we hint this as autocomplete="off" and this is a minor concesssion.