So I'm coming into agreement with Daniel here. My strong preference would be to remove the password field and replace it with a hash that had to be precomputed, and very strong documentation that stated the user needs to compute the hash with the mongodb_password function. All of the solutions are not satisfying in some way, but the proposal errs on the side of security over convenience.  It's something we're going to have to evaluate in the other database modules.