The passwords and tokens should be kept as char[] instead of String to avoid pooling the values in the JVM.
I'm not sure how this impacts the wizard pages which rely on Databinding.