[security-dev] PicketLink IDM API - Should PasswordCredential use char[] instead of String

It is a fairly common recommended practice that passwords are stored using character arrays instead of String - this means that as soon as it is finished with the array can be cleared instead of relying on the garbage collector to remote the String from the heap. Just thinking should PasswordCredential also do the same? Regards, Darran Lofthouse.