Ldap admin app : clear text password when using a static DN account for bind_DN bind_pass

Hi,

This is about https://extensions.xwiki.org/xwiki/bin/view/Extension/LDAP/Application/.
In Ldap login matching and Ldap password matching settings - which seems to fit with xwiki.cfg's bind_DN and bind_pass - we can either use var placeholder {{

{X}}} or specify a single regular LDAP service account to bind - let's imagine cn=xwikiapp,cn=services,dc=domain,dc=ltd for example. In this case we have no use of {{{X}

}} in either bind_DN or bind_pass so we can hide the password.

It also suggests the password is stored in clear text in database...

Cheers