Should the password be plain text when creating a user through the API?

[mpalmer (Matt Palmer)]

Yes, SSL is considered sufficient to protect secrets in-flight. Until the world sees the light and switches to something like TLS-SRP, sharing secrets over a secured channel are pretty much all we’ve got to work with.