The Welcome Message sent to newly registered users should be template-able.

Currently the admin can enter a text message that serves as the welcome message (via Admin Console > Settings > Authentication), however WebGUI::Auth::createAccountSave concatenates this with the user's username and password when constructing the email message to send.

The problem with this is that there is no way to send a welcome message without it containing the user's username and password, and in many circumstances email is not considered a secure means of communication.

I think the preferred way to do it would be to have a welcome message template that makes available username and password vars but which paranoid people can decide to not use in their welcome message.

Patrick