But the problem with comments is that they'll inevitably get out of sync with the code. And a wrong comment is far worse than no comment at all.
In a case like Colin's, I think something as simple as including "secure" or "secret" in the name of the variable would prevent this stuff from happening. If your variable is named `secureAccountCode` then it's unlikely you'll be silly enough to render it back to a hidden input (unless you're writing code comments for "Drunk Me" like the Disqus commenter on the article, in which case all bets are off).
There's a classic Joel on Software article about this, "Making Wrong Code Look Wrong" [1]