I am out of ideas then to prevent the security hole.  is there something else you want me to change?  Currently, anyone using play has passwords end up in the cookies in cleartext until something like this is merged in.