Putting unsecured ES on side, but logging passwords in plain text? That's a whole another level of stupidity.