Does the protection block the cred from being sent to the phishing site/malicious code or does it allow it, then alert? The UI indication looks like it blocks it - but there is a UI element prompting to change the user's password. Why would I need to change the password if it wasn't sent?