This problem existed in 2.x releases, but since 3.00 
release, the username/pwd shouldn't be displayed 
anywhere, EXCEPT in log/data files:

- In hts-log.txt: that's right, this is a problem!

- In various hts-cache files, that is, 
doit.log,new.ndx,winprofile.ini : can not be avoided

I will fix the hts-log.txt problem by removing this 
kind of information, but I can't do that in files from 
hts-cache due to update problems. (must keep the pwd 
to update/continue!)

I will add a warning, so that people not distribute 
the hts-cache folder among with other files when using 
password protected sites