That's unfortunate, but your passwords should be such that it would take an attacker millions of years to guess the password through HTTP requests.
That's a little bit Victim Blamey.
Security unfortunately relies on users doing things at least somewhat right.