The password field on the SMTP config screen really ought to be a password field, i.e. masked!