Saving and auto-filing of username/password is a feature of most modern browsers. And the user can generally choose to disable this feature on a per domain basis. But is the
Give the password input a randomly generated name that only you can recognize. Store that name, for example, in a hidden field, and then use that to get the inserted password. That way, even if the browser does cache the password, it won't be able to bring it back up next time the user visits.
Your users will likely at this point proceed to cache the passwords on a postit on the side of the monitor, but that's really a whole different battle.
The same method works well against spam, since most bots rely on finding common field names.