I would like to do it in 2 steps:
* step 1: create them in xwiki/xwiki/trunk.
* step 2: create some other place later on when we have our structure
cleaned up more.
One rationale now is to have the same release cycle for the site (
xwiki.org) as for the code so I think it makes sense, for now at least, to
have it in the same place as the code.
Any password in clear is always a VERY serious bug IMO. They should be
encrypted and only the owner should be able to know. Admins should be able
to reset passwords but they should NEVER EVER see a password created by
someone.