> To follow up on this, we had some more discussion internally and came up with a compromise. We could start by doing both: allowing for password_hash as a parameter, or allowing for the user/password combination with explicit documentation that the latter is unsafe. This would keep it in line with the existing modules, while allowing for the more secure version.

That seems like a sane compromise to me.  If folks are aware of the
risk and decide they are happy with the plain text in the catalog,
that is fine.  If they assume it is protected somehow, that isn't
fine.   This achieves the first, not the second, so we win. :)