If you're using private/appconfig.ini, you can put the passwords in the URI.
private/appconfig.ini should not be checked into source control, nor sent unsanitized to customers.
(The one "out of the box" with web2py should be considered a template;, which is okay check in or distribute. The real appconfig.ini should only be backed up in a secure place. The database credentials are a big reason for this, but appconfig.ini is entirely instance specific.)
/dps