Best practice:
fill your password only if the address in your browser matches the one of your Cozy and comes with a padlock.