Currently passwords are sent in clear with notifications. There should be an option to disable this behavior.