The login username and password are defined in config.h
#define BASICAUTH "YWRtaW46cGFzc3dvcmQ="
which is a base64 encoded string, the decoded value is
this is the default login name and password.
to change the login, figure your new username and password, say for example
testuser:12345
then go to
http://base64-encoder-online.waraxe.us website to get the base64 encoded value
the encoded value is dGVzdHVzZXI6MTIzNDU=
so you change the config.h entry to
#define BASICAUTH "dGVzdHVzZXI6MTIzNDU="
and next time it prompts for login, you enter testuser for username and 12345 for password.
The same base64 encoding is used for the email login and password, but they are separate for email. Change the value the same way as above, only do it separately for username, then for password value.
#define SMTPUSER "YWRtaW4="
#define SMTPPASSWORD "cGFzc3dvcmQ="
The login prompt is the same level of security you get with Neptune Apex controllers. I won't consider it secure by today's standards, but this is also what you get on a $500 controller. The ip address of all login attempts are logged in the controller log (the $500 controller does not). If needed, I can add code to increase the security level, but I don't see the need yet at this point.