This is a correct way to do login form auto-focus, checking to see if either username or password have focus already. This prevents someone from typing a username hitting TAB, then having JavaScript chime in, resetting focus to Username while user is typing in their password. In this case, the password is appended to the username which is in plaintext.