how to toggle password visibility with vanilla javascript