I have a problem with the downgraded protection on the password, but the abuse of significant location change notifications to start background http requests bothers me a lot more.
I hope a follow up post discusses how they removed this "feature" and took advantage of the new API for background updates.