+2
I would like to do it in 2 steps:
* step 1: create them in xwiki/xwiki/trunk.
* step 2: create some other place later on when we have our structure cleaned up more.
One rationale now is to have the same release cycle for the site ( xwiki.org) as for the code so I think it makes sense, for now at least, to have it in the same place as the code.
Any password in clear is always a VERY serious bug IMO. They should be encrypted and only the owner should be able to know. Admins should be able to reset passwords but they should NEVER EVER see a password created by someone.