If that username and password are just for Hypersonic, I think it's okay for them to be hard-coded.  The hypersonic stuff should be an internal implementation detail, so the user should care about (or know how to) configuring it.