This means that an `<input type=password>` will show the correct number of *s in it when non-ASCII characters are entered. We also don't need to perform text-transform on these as that doesn't affect the output length, so I've moved it earlier.
