The api works like the interface and in the interface you can not set the password in the first step as well as its on a different tab, so the password for the stats is always set during a update of the vhost and not during initial creation. If you like to get this changed in future versions, feel free to make a feature request in the bugtracker. Please make a bugreport in the bugtracker and we will check that.