Not sure if this is an issue, or a feature. With HMBradley's security incident I was wondering the possibility of changing to app credentials. That way the public password is not used by aggregators.